Re: ELF doubt

[Alex Pennace]

On Thu, Nov 08, 2001 at 10:11:22PM -0800, Anumula Venkat wrote:
>    Though it may not be question related to this group
> i am asking this question. Kindly clarify me.
> 
> I am reading runtime image of kernel module from
> another module. I heard that First 52 bytes will bw
> ELF header. But i got strange values. Can somebody
> clarify my doubt.

My understanding may be flawed.

linux/vmlinux is an ELF file with a full symbol table; nm uses this to
make System.map. linux/vmlinux is made by the linker folliwng the
instructions in a linker file; this linker file tells the linker
"ignore your defaults, the image does not start at absolute virtual
address 0x804800, it starts here." It also tells the linker how to
shuffle about special kernel sections, like .text.init and .data.init.

Now that the code knows where it will be in memory, nm is run to make
System.map. Then the architecture-specific boot stuff takes over. At
some point the equivalent of "objcopy -O binary" is run on
linux/vmlinux. This strips all the ELF stuff out, leaving code that
still expects to be loaded at the address it was destined for. This
ELF-less image is what you are reading in memory.