3

I wrote the following (fasm) assembly program:

format ELF64 executable

segment readable executable

; sys_exit, sys_write, strlen and print are from io.inc and
; unistd64.inc at: https://github.com/pbohun/fasm-tutorials
sys_exit            =   60
sys_write           =   1
entry main

strlen:
    push    rdi             ; push to stack
    push    rcx             ; push to stack
    sub     rcx, rcx        ; set rcx to 0
    mov     rcx, -1         ; move -1 to rcx
    sub     al, al          ; set al to 0
    cld                     ; clear the direction flags
    repne   scasb           ; repeat if not equal to al
    neg     rcx             ; negate rcx
    sub     rcx, 1          ; subtract 1 from rcx
    mov     rax, rcx        ; move value from rcx to rax
    pop     rcx             ; restore original rcx value
    pop     rdi             ; restore original rdi value
    ret

print:
    call    strlen          ; get string length
    mov     rdx, rax        ; move string length to rdx
    mov     rsi, rdi        ; move address of string to rdi
    mov     rdi, 1          ; stdout
    mov     rax, sys_write
    syscall
    ret

main:
    mov rdi, msg
    call print
    xor rdi, rdi
    mov rax, sys_exit
    syscall

segment readable
msg db "This is a message.", 0xA, 0

When I disassemble with IDA Pro, under the segments I see this:

IDA Pro Segments Tab

My question is, why are both segments called LOAD? What is the meaning behind this? I did not name the segments in my program.

2 Answers 2

2

The segments are called LOAD because that is the default name given to segments loaded from an ELF in IDA when they have no name.

The first segment is the equivalent of .text, it contains executable code.

The second segment is the equivalent of .rdata, it contains read-only data that is not executable.

0

These two segments are used to map the content of ELF file to memory. In other word, the content of ELF is only and only will map to these two segments (a.k.a program header).

2
  • Why are you claiming that those two segments both map to the file header? Clearly only the first one (lower virt. addr.) does as that's the one that contains the ELF header and the code, whereas the second one doesn't contain the ELF header, but contains the data string.
    – 0xC0000022L
    Jan 19 at 8:53
  • Usually a program header table has several segments in which two are LOAD segments. AFAIK, the 1st LOAD segment is mostly filled with executable instructions and unchangeable constants. The 2nd segment consists mostly of the global variables used in the executable binary. Therefore, only these two segments will capture the content of ELF file. Jan 19 at 14:37

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.