Question about my program header (64 bit)

[markq]

Hello,

I am a bit puzzled by the output of my kernel.bin in hex format. To begin with, my kernel.bin file is an ELF file that has two program headers. Below I have found out using the command readelf. Next I printed kernel.bin in hex using hexdump, according the ELF header my program header starts at address 0x40, however when I check address 0x40 I found 7 entries and the 8th entry seems to be the beginning of the next program header. This has confused me a lot, could someone tell me what could be the reason? Am I reading the hex file wrong?

readelf -l kernel.bin

Code: Select all

Elf file type is EXEC (Executable file)
Entry point 0xc0100000
There are 2 program headers, starting at offset 64

Program Headers:
  Type           Offset             VirtAddr           PhysAddr
                 FileSiz            MemSiz              Flags  Align
  LOAD           0x0000000000001000 0x00000000c0100000 0x0000000000000000
                 0x0000000000001000 0x0000000000001000  R E    1000
  LOAD           0x0000000000002000 0x00000000c0101000 0x0000000000001000
                 0x0000000000001000 0x0000000000001000  RW     1000

 Section to Segment mapping:
  Segment Sections...
   00     .text 
   01     .data .eh_frame 

Output of hexdump

Code: Select all

00000000  7f 45 4c 46 02 01 01 00  00 00 00 00 00 00 00 00  |.ELF............|
00000010  02 00 00 00 01 00 00 00  00 00 10 c0 00 00 00 00  |................|
00000020  40 00 00 00 00 00 00 00  10 32 00 00 00 00 00 00  |@........2......|
00000030  00 00 00 00 40 00 38 00  02 00 40 00 08 00 05 00  |[email protected]...@.....|
00000040  01 00 00 00 05 00 00 00  00 10 00 00 00 00 00 00  |................|
00000050  00 00 10 c0 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000060  00 10 00 00 00 00 00 00  00 10 00 00 00 00 00 00  |................|
00000070  00 10 00 00 00 00 00 00  01 00 00 00 06 00 00 00  |................|
00000080  00 20 00 00 00 00 00 00  00 10 10 c0 00 00 00 00  |. ..............|
00000090  00 10 00 00 00 00 00 00  00 10 00 00 00 00 00 00  |................|
*
000000b0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
*

as you can see

Code: Select all

00000040  01 00 00 00 05 00 00 00  00 10 00 00 00 00 00 00  |................|
00000050  00 00 10 c0 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000060  00 10 00 00 00 00 00 00  00 10 00 00 00 00 00 00  |................|
00000070  00 10 00 00 00 00 00 00

seems to be the first program header, but there are only 7 entries.

This seems to be the second program header, but this time there seems to be 5 entries starting from 01 00 00 00 06 00 00 00.

Code: Select all

00000070  00 10 00 00 00 00 00 00  01 00 00 00 06 00 00 00  |................|
00000080  00 20 00 00 00 00 00 00  00 10 10 c0 00 00 00 00  |. ..............|
00000090  00 10 00 00 00 00 00 00  00 10 00 00 00 00 00 00  |................|
*
000000b0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|

[markq]

It seems there is an entry in the ELF header that specifies the program header size. In this case there seems to be only 7 entries. I guess that answers my question.