elf segment to section mapping mismatch

Question

I have encountered a pretty mysterious problem after rewriting a ELF binary. I have rewritten a binary using libelf library. Basically I am just replacing some instructions in .text with same number of NOPs. This doesn't change size of any sections, as is evident by readelf output also. However there is some strange mismatch, with respect to original file, in segments to sections mapping after rewriting.

readelf -l output before rewriting:

Elf file type is EXEC (Executable file)
Entry point 0x202a0
There are 8 program headers, starting at offset 52

Program Headers:
Type           Offset   VirtAddr   PhysAddr   FileSiz MemSiz  Flg Align
EXIDX          0x000964 0x10020964 0x10020964 0x00230 0x00230 R   0x4
LOAD           0x010000 0x00020000 0x00020000 0x20000 0x20000 R E 0x10000
LOAD           0x000000 0x10020000 0x10020000 0x00c1c 0x00c1c R   0x10000
LOAD           0x000c20 0x10030c20 0x10030c20 0x00b18 0x010b4 RW  0x10000
NOTE           0x000134 0x10020134 0x10020134 0x0003c 0x0003c R   0x4
TLS            0x000c20 0x10030c20 0x10030c20 0x00478 0x00478 R   0x8
GNU_EH_FRAME   0x000b94 0x10020b94 0x10020b94 0x00014 0x00014 R   0x4
GNU_STACK      0x000000 0x00000000 0x00000000 0x00000 0x00000 RWE 0x10

Section to Segment mapping:
Segment Sections...
00     .ARM.exidx 
01     .init .text .fini 
02     .note.NaCl.ABI.arm .note.gnu.build-id .rodata .ARM.extab .ARM.exidx
   .eh_frame_hdr .eh_frame 
03     .tdata .init_array .fini_array .jcr .got .data .bss 
04     .note.NaCl.ABI.arm .note.gnu.build-id 
05     .tdata 
06     .eh_frame_hdr 
07

readelf -l after rewriting:

Elf file type is EXEC (Executable file)
Entry point 0x202a0
There are 8 program headers, starting at offset 52

Program Headers:
Type           Offset   VirtAddr   PhysAddr   FileSiz MemSiz  Flg Align
EXIDX          0x000964 0x10020964 0x10020964 0x00230 0x00230 R   0x4
LOAD           0x010000 0x00020000 0x00020000 0x20000 0x20000 R E 0x10000
LOAD           0x000000 0x10020000 0x10020000 0x00c1c 0x00c1c R   0x10000
LOAD           0x000c20 0x10030c20 0x10030c20 0x00b18 0x010b4 RW  0x10000
NOTE           0x000134 0x10020134 0x10020134 0x0003c 0x0003c R   0x4
TLS            0x000c20 0x10030c20 0x10030c20 0x00478 0x00478 R   0x8
GNU_EH_FRAME   0x000b94 0x10020b94 0x10020b94 0x00014 0x00014 R   0x4
GNU_STACK      0x000000 0x00000000 0x00000000 0x00000 0x00000 RWE 0x10

Section to Segment mapping:
Segment Sections...
00     
01     .fini .comment .ARM.attributes .debug_aranges .debug_info   
.debug_abbrev 
02     
03     .bss 
04     
05     
06     
07

What might be the reason behind this?

Employed Russian Employed Russian · Accepted Answer · 2015-08-26T04:09:45

What might be the reason behind this?

The most likely reason is that whatever tool you used overwrote more than just some instructions from .text.

In particular, it appears to have overwritten your section table. You can compare the before/after output from readelf -WS to confirm this, or even readelf -W --all to see what else might have been overwritten.

elf segment to section mapping mismatch

1 Answers