How does ELF file format defines the stack?

5
votes

I'm studying the ELF file format, so I compiled a small program, dumped the section headers and their contents from the resulting executable.

The ELF header contains the entry point address, which points into start of the .text section.

I also found the .data section that contains the static data and .rodata that contains the read only data... I expect there is a section for the stack too, but I can't find that section.

I also expect that at some point ESP is set to the top of some section but I can't find anything like that in the disassembly.

So how does ESP gets its initial value?

1
linuxelf

1 Answers

9
votes

The following figure describes the memory map of a typical C ELF executable on x86.

Memory map of an C ELF executable on x86

  • The process loads the .text and .data sections at the base address.

  • The main-stack is located just below and grows downwards.

  • Each thread and function-call will have its own-stack.
    This is located located below the main-stack.

  • Each stack is separated by a guard page to detect Stack-Overflow.

Hence one does NOT need a dedicated stack section in the ELF file.

However within the man pages for ELF, one does find a couple of things in an ELF file that control the stack attributes. Mainly the executable permissions to the stack in memory.

  1. PT_GNU_STACK
    GNU extension which is used by the Linux kernel to control the state of the stack via the flags set in the p_flags member.

  2. .note.GNU-stack
    This section is used in Linux object files for declaring stack attributes. This section is of type SHT_PROGBITS. The only attribute used is SHF_EXECINSTR. This indicates to the GNU linker that the object file requires an executable stack.