Home/ Questions/Q 8078737
In Process

The Archive Base Latest Questions

Editorial Team
  • 0
Asked: 2026-06-05T15:53:28+00:00

I am running some C code, compiled to 32bit x86 on Linux. And I

  • 0

I am running some C code, compiled to 32bit x86 on Linux. And I am trying to access some memory. Apperently I can write to .bss and .data and to the stack. Some time ago, the .ctors and .dtors segments used to be writable, but it seems they are gone.

Without trial-and-error, how can I found out to which sections in memory the segments are mapped? How can I find out which addresses are mapped to writable memory and which are executable?

Share

Leave an answer

You must login to add an answer.

Need An Account,

1 Answer

  1. Editorial Team

    Without trial-and-error, how can I found out to which sections in memory the segments are mapped?

    Sections and segments have specific meaning when you talk about ELF executables, and your usage above doesn’t agree with that meaning.

    ELF sections don’t matter at load time, only (loadable) segments do.

    The readelf -l a.out command provides exactly the mapping from ELF sections to segments. E.g.

    readelf -l /bin/date

Elf file type is EXEC (Executable file)
Entry point 0x8048c60
There are 6 program headers, starting at offset 52

Program Headers:
  Type           Offset   VirtAddr   PhysAddr   FileSiz MemSiz  Flg Align
  PHDR           0x000034 0x08048034 0x08048034 0x000c0 0x000c0 R E 0x4
  INTERP         0x0000f4 0x080480f4 0x080480f4 0x00013 0x00013 R   0x1
      [Requesting program interpreter: /lib/ld-linux.so.2]
  LOAD           0x000000 0x08048000 0x08048000 0x05fe0 0x05fe0 R E 0x1000
  LOAD           0x006000 0x0804e000 0x0804e000 0x00208 0x00334 RW  0x1000
  DYNAMIC        0x006078 0x0804e078 0x0804e078 0x000c8 0x000c8 RW  0x4
  NOTE           0x000108 0x08048108 0x08048108 0x00020 0x00020 R   0x4

 Section to Segment mapping:
  Segment Sections...
   00
   01     .interp
   02     .interp .note.ABI-tag .hash .dynsym .dynstr .gnu.version .gnu.version_r .rel.dyn .rel.plt .init .plt .text .fini .rodata
   03     .data .eh_frame .dynamic .ctors .dtors .jcr .got .bss
   04     .dynamic
   05     .note.ABI-tag

    This tells you that .ctors is mapped to segment 3, which is writable (this output is from ancient UnitedLinux 1.0 distribution).

    Nowadays, .ctors is put into a segment different from .data, and protected from writing after relocation via special GNU_RELRO segment.

    • 0