Page 1 of 1

Strange ELF64 header content.

Posted: Tue Jun 24, 2014 8:18 am
by Roman
Why does the ELF header says entry starts at 0x400F2, when the entire file is only 0x328 bytes? The real entry is located at 0xF2 (or 0xF0).

Code: Select all

00000000   7F 45 4C 46  02 01 01 00  00 00 00 00  00 00 00 00  02 00 3E 00  01 00 00 00 *0x18 starts here ->* F2 00 40 00  00 00 00 00  40 00 00 00  00 00 00 00  A8 01 00 00
0000002C   00 00 00 00  00 00 00 00  40 00 38 00  03 00 40 00  06 00 05 00  01 00 00 00  05 00 00 00  00 00 00 00  00 00 00 00  00 00 40 00  00 00 00 00
00000058   00 00 40 00  00 00 00 00  60 01 00 00  00 00 00 00  60 01 00 00  00 00 00 00  00 00 20 00  00 00 00 00  50 E5 74 64  04 00 00 00  10 01 00 00
00000084   00 00 00 00  10 01 40 00  00 00 00 00  10 01 40 00  00 00 00 00  14 00 00 00  00 00 00 00  14 00 00 00  00 00 00 00  04 00 00 00  00 00 00 00
000000B0   51 E5 74 64  07 00 00 00  00 00 00 00  00 00 00 00  00 00 00 00  00 00 00 00  00 00 00 00  00 00 00 00  00 00 00 00  00 00 00 00  00 00 00 00
000000DC   00 00 00 00  08 00 00 00  00 00 00 00  00 00 00 00  00 00 00 00  EB 00 E9 01  00 00 00 90  55 48 89 E5  48 C7 45 F8  00 80 0B 00  48 8B 45 F8
00000108   C6 00 4B FA  F4 5D C3 00  01 1B 03 3B  14 00 00 00  01 00 00 00  E8 FF FF FF  30 00 00 00  00 00 00 00  14 00 00 00  00 00 00 00  01 7A 52 00
00000134   01 78 10 01  1B 0C 07 08  90 01 00 00  1C 00 00 00  1C 00 00 00  B0 FF FF FF  17 00 00 00  00 41 0E 10  86 02 43 0D  06 52 0C 07  08 00 00 00
00000160   47 43 43 3A  20 28 47 4E  55 29 20 34  2E 38 2E 31  00 00 2E 73  68 73 74 72  74 61 62 00  2E 74 65 78  74 00 2E 65  68 5F 66 72  61 6D 65 5F
0000018C   68 64 72 00  2E 65 68 5F  66 72 61 6D  65 00 2E 63  6F 6D 6D 65  6E 74 00 00  00 00 00 00  00 00 00 00  00 00 00 00  00 00 00 00  00 00 00 00
000001B8   00 00 00 00  00 00 00 00  00 00 00 00  00 00 00 00  00 00 00 00  00 00 00 00  00 00 00 00  00 00 00 00  00 00 00 00  00 00 00 00  00 00 00 00
000001E4   00 00 00 00  0B 00 00 00  01 00 00 00  06 00 00 00  00 00 00 00  F0 00 40 00  00 00 00 00  F0 00 00 00  00 00 00 00  1F 00 00 00  00 00 00 00
00000210   00 00 00 00  00 00 00 00  10 00 00 00  00 00 00 00  00 00 00 00  00 00 00 00  11 00 00 00  01 00 00 00  02 00 00 00  00 00 00 00  10 01 40 00
0000023C   00 00 00 00  10 01 00 00  00 00 00 00  14 00 00 00  00 00 00 00  00 00 00 00  00 00 00 00  04 00 00 00  00 00 00 00  00 00 00 00  00 00 00 00
00000268   1F 00 00 00  01 00 00 00  02 00 00 00  00 00 00 00  28 01 40 00  00 00 00 00  28 01 00 00  00 00 00 00  38 00 00 00  00 00 00 00  00 00 00 00
00000294   00 00 00 00  08 00 00 00  00 00 00 00  00 00 00 00  00 00 00 00  29 00 00 00  01 00 00 00  30 00 00 00  00 00 00 00  00 00 00 00  00 00 00 00
000002C0   60 01 00 00  00 00 00 00  11 00 00 00  00 00 00 00  00 00 00 00  00 00 00 00  01 00 00 00  00 00 00 00  01 00 00 00  00 00 00 00  01 00 00 00
000002EC   03 00 00 00  00 00 00 00  00 00 00 00  00 00 00 00  00 00 00 00  71 01 00 00  00 00 00 00  32 00 00 00  00 00 00 00  00 00 00 00  00 00 00 00
00000318   01 00 00 00  00 00 00 00  00 00 00 00  00 00 00 00

Re: Strange ELF64 header content.

Posted: Tue Jun 24, 2014 8:20 am
by Combuster
Do you know the difference between VMA, LMA and File offset?


Edit: magic post count :D

Re: Strange ELF64 header content.

Posted: Tue Jun 24, 2014 9:05 am
by Roman
Combuster wrote:Do you know the difference between VMA, LMA and File offset?


Edit: magic post count :D
Oh, it's a VMA, so as I understand my OS needs to move the entry to this virtual address?

Re: Strange ELF64 header content.

Posted: Wed Jun 25, 2014 3:55 am
by max
Roman wrote:Oh, it's a VMA, so as I understand my OS needs to move the entry to this virtual address?
VMA, LMA (and of course, file offset just means file offset):
LD documentation wrote:Every loadable or allocatable output section has two addresses. The
first is the VMA, or virtual memory address. This is the address the
section will have when the output file is run. The second is the LMA,
or load memory address. This is the address at which the section will
be loaded. In most cases the two addresses will be the same. An
example of when they might be different is when a data section is
loaded into ROM, and then copied into RAM when the program starts up
(this technique is often used to initialize global variables in a ROM
based system). In this case the ROM address would be the LMA, and the
RAM address would be the VMA.
Also, go to http://wiki.osdev.org/ELF