Segfault when reading ELF Shdr of own executable - c++

Question

I'm trying to read the symbol table of the program's own ELF binary as part of a symbolizer. Part of this involves finding the ELF start, then ELF shdr, etc. I must be doing something wrong, though, because despite e_shoff matching what I see by readelfing the binary manually and the start address looking reasonable, I cannot read the shdr.
#ifndef _GNU_SOURCE
#define _GNU_SOURCE
#endif
#include <assert.h>
#include <dlfcn.h>
#include <elf.h>
#include <link.h>
#include <stdio.h>
#include <stdlib.h>
static int findELFStartCallback(struct dl_phdr_info *info, size_t size,
void *data) {
static_cast<void>(size);
static int address_found = 0;
if (address_found) {
return 0;
}
address_found = 1;
fprintf(stderr, "relocation: 0x%lx\n", (long)info->dlpi_addr);
for (ElfW(Half) i = 0; i < info->dlpi_phnum; i++) {
if (info->dlpi_phdr[i].p_type == PT_LOAD) {
auto result = reinterpret_cast<void *>(info->dlpi_addr +
info->dlpi_phdr[i].p_vaddr);
fprintf(stderr, "a.out loaded at %p\n", result);
*reinterpret_cast<void **>(data) = result;
break;
}
}
return 0;
}
static void *findELFStart() {
void *result = nullptr;
dl_iterate_phdr(findELFStartCallback, &result);
return result;
}
static void checkELF(ElfW(Ehdr) * ehdr) {
assert(ehdr->e_ident[EI_MAG0] == ELFMAG0 && "bad magic number");
assert(ehdr->e_ident[EI_MAG1] == ELFMAG1 && "bad magic number");
assert(ehdr->e_ident[EI_MAG2] == ELFMAG2 && "bad magic number");
assert(ehdr->e_ident[EI_MAG3] == ELFMAG3 && "bad magic number");
}
int main(int argc, char *argv[]) {
char *exe_ = nullptr;
exe_ = reinterpret_cast<char *>(findELFStart());
assert(exe_ != nullptr && "could not find ELF header");
checkELF(reinterpret_cast<ElfW(Ehdr) *>(exe_));
auto elf = reinterpret_cast<ElfW(Ehdr) *>(exe_);
fprintf(stderr, "e_shoff is %ld (0x%lx)\n", elf->e_shoff, elf->e_shoff);
auto shdr = reinterpret_cast<ElfW(Shdr) *>(exe_ + elf->e_shoff);
fprintf(stderr, "shdr is %ld (%p)\n", (size_t)shdr, (void*)shdr);
const char *str = exe_ + shdr[elf->e_shstrndx].sh_offset; // boom
}
I get a segfault. When I load it in GDB, it looks like shdr is indeed a bad pointer. What am I missing here?
Sample output:
computer% ./p/dladdr
relocation: 0x0
a.out loaded at 0x400000
e_shoff is 24528 (0x5fd0)
shdr is 4218832 (0x405fd0)
zsh: segmentation fault (core dumped) ./p/dladdr
computer%
EDIT: After seeing Reading ELF header of loaded shared object during runtime maybe the sections just aren't loaded into memory...
EDIT: I finished the symbolizer and it's available here

Answer 1

maybe the sections just aren't loaded into memory...
That's exactly right. Here is readelf -WS /bin/date on my system:
Section Headers:
[Nr] Name Type Address Off Size ES Flg Lk Inf Al
[ 0] NULL 0000000000000000 000000 000000 00 0 0 0
[ 1] .interp PROGBITS 0000000000000318 000318 00001c 00 A 0 0 1
[ 2] .note.gnu.property NOTE 0000000000000338 000338 000050 00 A 0 0 8
[ 3] .note.gnu.build-id NOTE 0000000000000388 000388 000024 00 A 0 0 4
[ 4] .note.ABI-tag NOTE 00000000000003ac 0003ac 000020 00 A 0 0 4
...
[26] .bss NOBITS 000000000001a0a0 019098 000130 00 WA 0 0 32
[27] .gnu.build.attributes NOTE 000000000001c1d0 019098 000248 00 0 0 4
[28] .gnu_debuglink PROGBITS 0000000000000000 0192e0 000024 00 0 0 4
[29] .gnu_debugdata PROGBITS 0000000000000000 019304 0005a0 00 0 0 1
[30] .shstrtab STRTAB 0000000000000000 0198a4 00013e 00 0 0 1
Note that .shstrtab does not have the A (allocated) flag. The contents of this section is not used at runtime, so there is no reason to load it into memory, and so it isn't.
If you want to access .shstrtab, you need to either read it from the file on disk, or mmap the entire file (the kernel only mmaps the parts covered by PT_LOAD segments, not the entire file).