So I am learning about ELF, and am looking through a binary in Ghidra as I do. I've made sense of the ELF header, and now I am looking through the program header table.
My binary has a bunch of entries in the program header table, but I am hung up on one in particular...
From referencing...
http://www.sco.com/developers/gabi/latest/ch5.pheader.html#p_flags
...I can see what the different flags mean. Of relevance:
p_offset = 0xABCDEF
p_vaddr = 0x1BCDEF
p_filesz = <number>
p_memsz = <bigger number>
I am able to go to the p_vaddr value in the binary, and it brings me to the .ctors
section. Where I do see what appears to be a list of pointers, but currently those pointers do not represent valid virtual addresses (by currently I mean they are not virtual addresses that I can "go" to in Ghidra). When I run the program dynamically in gdb though, I can run x addr_of_interest
and it succeeds and says it is pointing to something in a library blah blah.
I found a relevant link from GCC too, but it did not answer my question as far as I could tell...
https://gcc.gnu.org/onlinedocs/gccint/Initialization.html
My question therefore is this: When/how are these pointers mapped to valid memory, and where in the ELF file is the information that would tell me how this happens?
.ctors
and not, for example,.got
?__CTOR_LIST__
and once you jump there an auto generated comment that says.ctors