In order to accomplish that you need some knowledge about ELF files. I'm not going explain every detail about ELF files since is a lot to cover so I'll try to be as precise as I can.
NOTE #01: I will use radare2 to dissect the file but you can do it with any hex editor out there.
NOTE #02: Here is the link to the cpp file that I compile to explain you ELF files. Feel free to take it or make your own.
First, you need to know the structure of headers in ELF files. Here you can see the structures of the headers.
The first thing we want to look for is
e_ident that represent the format of the file (32bit or 64bit) since the file header will be different depending of the file format.
e_ident offset=0x04, size=1byte
Go to the 0x04 offset of the file and check one byte. (
s means seek)
:> s 0x04
e_ident = 0x02 means 64bit format.
Now that we now the file format we need to know the offset of the section header(
e_shoff), the size of each entry(
e_shentsize), and the number of entries in the section header(
e_shoff offset=0x28 size=8bytes
e_shentsize offset=0x3A size=2bytes
e_shnum offset=0x3C size=2bytes
:> s 0x28
0x00000028 e03b 0000 0000 0000
:> s 0x3A
:> s 0x3C
e_shoff = 0x3be0 This is the offset of the section header.
e_shentsize = 0x40 (64 bytes)
e_shnum = 0x1d (29 entries)
We also going to need the index of the section header that contains the names of each section header. This is store in
e_shstrndx offset=0x3E size=2bytes
:> s 0x3e
e_shstrndx = 0x1c (entry 28)
With the entry number you can get the address of shstrtab:
:> s 0x3be0+(0x40*0x1c)+0x18
0x000042f8 df3a 0000 0000 0000
shstrtab = 0x3adf
Now that you have that information you can run a loop that checks all the section entries:
for (i=0; i<e_shnum; i++)
entryN = e_shoff+(e_shentsize*i);
NOTE #03:I'll not print those values here because I have to explain more but that will give you something similar to the command
readelf -W -l [program]
Each entry has a structure like the section header. To get the name of each entry add
I'm only going to show you how I got
.text but the idea will be the same for any section entry. In my case
.text was the entry 0x0e(14). I'm going to need
sh_name, the offset in the file
sh_offset, and the size
sh_name offset=0x00 size=4bytes
sh_offset offset=0x18 size=8bytes
sh_size offset=0x20 size=8bytes
:> s 0x3be0+(0x40*0x0e)+0x00
0x00003f60 9d00 0000
// Get the name
:> s 0x3adf+0x9d
0x00003b7c 2e74 6578 7400 2e66 696e 6900 2e72 6f64 .text..fini..rod
:> s 0x3be0+(0x40*0x0e)+0x18
0x00003f78 9010 0000 0000 0000
:> s 0x3be0+(0x40*0x0e)+0x20
0x00003f80 3102 0000 0000 0000
entryName = 0x3be0 // .text
sh_offset = 0x1090
sh_size = 0x0231 (561bytes)
If you can't found it this way then your ELF file must be corrupted. You can take the one I compile to follow this explanation. Good luck.