List All Sections of an ELF File

ELF Section Headers

After the ELF header comes the section header table, which describes all sections in the file. Sections are the building blocks for linking: .text holds code, .data holds initialized globals, .bss reserves space for zero-initialized data.

Section Header Structure

Each Elf64_Shdr entry contains:

• sh_name: Offset into .shstrtab for the section name
• sh_type: Section type (PROGBITS, SYMTAB, STRTAB, NOBITS, etc.)
• sh_flags: Writable, allocatable, executable
• sh_offset: File offset to section data
• sh_size: Size in bytes

Common flags you will encounter:

• SHF_WRITE (0x1): Writable at runtime
• SHF_ALLOC (0x2): Loaded into memory
• SHF_EXECINSTR (0x4): Contains executable instructions

For example, .text typically has SHF_ALLOC | SHF_EXECINSTR, while .data has SHF_WRITE | SHF_ALLOC.

For This Exercise

You will walk the section header table and list every section with its name, type, flags, offset, and size. This is exactly what readelf -S prints, and reverse engineers scan section flags first when triaging an unfamiliar binary.

Walking the Section Table

The section count lives in e_shnum, and each entry is e_shentsize bytes wide. You iterate from e_shoff to e_shoff + e_shnum * e_shentsize, resolving each name through .shstrtab. Linkers merge sections with compatible flags during linking, and loaders map only sections with SHF_ALLOC set into the process address space at runtime.