ELF 文件中的 build-id 数据偏移量

Question

I need to modify the build-id of the ELF notes section. I found out that it is possible here . Also found out that I can do it by modifying this code . What I can't figure out is data location. Here is what I'm talking about.

$ eu-readelf -S myelffile

Section Headers:
[Nr] Name                 Type         Addr             Off      Size     ES Flags Lk Inf Al
...
[ 2] .note.ABI-tag        NOTE         000000000000028c 0000028c 00000020  0 A      0   0  4
[ 3] .note.gnu.build-id   NOTE         00000000000002ac 000002ac 00000024  0 A      0   0  4
...


$ eu-readelf -n myelffile

Note section [ 2] '.note.ABI-tag' of 32 bytes at offset 0x28c:
  Owner          Data size  Type
  GNU                   16  GNU_ABI_TAG
    OS: Linux, ABI: 3.14.0

Note section [ 3] '.note.gnu.build-id' of 36 bytes at offset 0x2ac:
  Owner          Data size  Type
  GNU                   20  GNU_BUILD_ID
    Build ID: d75a086c288c582036b0562908304bc3a8033235
             

.note.gnu.build-id section is 36 bytes. The build id is 20 bytes. What are the other 16 bytes?

I played with the code a bit and read 36 bytes of myelffile at offset 0x2ac . Got the following 040000001400000003000000474e5500d75a086c288c582036b0562908304bc3a8033235 .

Then I decided to use Elf64_Shdr definition , so I read data at address 0x2ac + sizeof(Elf64_Shdr.sh_name) + sizeof(Elf64_Shdr.sh_type) + sizeof(Elf64_Shdr.sh_flags) and I got my build id, d75a086c288c582036b0562908304bc3a8033235 . It does makes sense why I got it, sizeof(Elf64_Shdr.sh_name) + sizeof(Elf64_Shdr.sh_type) + sizeof(Elf64_Shdr.sh_flags) = 16 bytes , but according to Elf64_Shdr definition I should be pointing to Elf64_Addr sh_addr , ie section virtual address.

So what is not clear to me is what are the other 16 bytes of the section? What do they represent? I can't reconcile the Elf64_Shdr definition and the results I'm getting from my experiments.

Answer 1

.note.gnu.build-id section is 36 bytes. The build id is 20 bytes. What are the other 16 bytes?

Each .note.* section starts with Elf64_Nhdr (12 bytes), followed by (4-byte aligned) note name of variable size ( GNU\0 here), followed by (4-byte aligned) actual note data. Documentation .

Looking at /bin/date on my system:

 eu-readelf -Wn /bin/date

Note section [ 2] '.note.ABI-tag' of 32 bytes at offset 0x2c4:
  Owner          Data size  Type
  GNU                   16  GNU_ABI_TAG
    OS: Linux, ABI: 3.2.0

Note section [ 3] '.note.gnu.build-id' of 36 bytes at offset 0x2e4:
  Owner          Data size  Type
  GNU                   20  GNU_BUILD_ID
    Build ID: 979ae4616ae71af565b123da2f994f4261748cc9

What are the bytes at offset 0x2e4 ?

 dd bs=1 skip=$((0x2e4)) count=36 < /bin/date | xxd

00000000: 0400 0000 1400 0000 0300 0000 474e 5500  ............GNU.
00000010: 979a e461 6ae7 1af5 65b1 23da 2f99 4f42  ...aj...e.#./.OB
00000020: 6174 8cc9                                at..

So we have: .n_namesz == 4 , .n_descsz == 20 , .n_type == 3 == NT_GNU_BUILD_ID , followed by 4-byte GNU\0 note name, followed by 20 bytes of actual build-id bytes 0x97 , 0x9a , etc.