Distinguish .shstrtab and .strtab in ELF file

Question

I'm wondering how a .shstrtab is identified compared to a .strtab when parsing an ELF file? From reading elf(5) - Linux manual page both are of section header type SHT_STRTAB, so how would I know if the one I encounter is one or the other?

Their descriptions are:

.shstrtab
    This section holds section names.  This section is of type
    SHT_STRTAB.  No attribute types are used.

.strtab
    This section holds strings, most commonly the strings that
    represent the names associated with symbol table entries.  If
    the file has a loadable segment that includes the symbol
    string table, the section's attributes will include the
    SHF_ALLOC bit.  Otherwise, the bit will be off.  This section
    is of type SHT_STRTAB.

When doing readelf file.o, I see the following:

...
[18] .strtab           STRTAB           0000000000000000  00000548
       0000000000000033  0000000000000000           0     0     1
[19] .shstrtab         STRTAB           0000000000000000  000007a8
       00000000000000a8  0000000000000000           0     0     1

so they appear the same to me except the offset.

Whim

Answer 1

From the same docs: e_shstrndx: This member [in ElfN_Ehdr] holds the section header table index of the entry associated with the section name string table. If the file has no section name string table, this member holds the value SHN_UNDEF.

Whim

Answer 2

As you have already shown, there may be multiple string tables in an ELF file, which all share the section type STRTAB.

Usually there are three of them, which you can distinguish based on information from other section headers - without necessarily having to look at their name.

(shortened) output of readelf -a:

ELF Header:
...
  Size of section headers:           64 (bytes)
  Number of section headers:         32
  Section header string table index: 30

Section Headers:
  [Nr] Name              Type             Address           Offset
       Size              EntSize          Flags  Link  Info  Align
...
  [ 6] .dynsym           DYNSYM           0000000000000408  00000408
       0000000000000360  0000000000000018   A       7     1     8
  [ 7] .dynstr           STRTAB           0000000000000768  00000768
       0000000000000230  0000000000000000   A       0     0     1
...
  [23] .dynamic          DYNAMIC          0000000000003ce0  00002ce0
       0000000000000200  0000000000000010  WA       7     0     8
...
  [28] .symtab           SYMTAB           0000000000000000  00003080
       0000000000000a08  0000000000000018          29    47     8
  [29] .strtab           STRTAB           0000000000000000  00003a88
       00000000000005f7  0000000000000000           0     0     1
  [30] .shstrtab         STRTAB           0000000000000000  0000407f
       0000000000000126  0000000000000000           0     0     1

Dynamic section at offset 0x2ce0 contains 28 entries:
  Tag        Type                         Name/Value
...
 0x0000000000000005 (STRTAB)             0x768
 0x0000000000000006 (SYMTAB)             0x408
...

---

.dynstr

The .dynstr section holds the names of symbols used for dynamic linking. These symbols are stored in the .dynsym table.

You can identify the string table associated with a dynamic symbol table via two independent means:

1. Parse the DYNAMIC section. There should be two entries STRTAB and SYMTAB, which hold the offsets of the dynamic string and symbol tables, respectively.
2. Look for a section of type DYNSYM. Usually, its section header should store the index of the associated string table section in its sh_link field (this is marked as "operating system-specific" in the ELF specification, but appears to work well in practice).

---

.strtab

The .strtab section is associated to the symbol table .symtab, which is there mostly for debugging purposes and not used at runtime.

You can identify the string table associated to .symtab again by looking at the sh_link field, which should contain the section index of the string table in most cases.

---

.shstrtab

This is the section header string table.

You can safely identify it by reading the e_shstrndx from the ELF header - this field contains the index of the section holding the section header string table.

Bettor