From 6aab4ac8407f7651ded654da1a4ec49cb4f4dc3d Mon Sep 17 00:00:00 2001 From: Arthur Beck Date: Mon, 11 Mar 2024 06:59:34 -0500 Subject: [PATCH] replace binary research github page with internet archive version --- src/content/chapters/4-becoming-an-elf-lord.mdx | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/content/chapters/4-becoming-an-elf-lord.mdx b/src/content/chapters/4-becoming-an-elf-lord.mdx index 29d038b..f8eb2ef 100644 --- a/src/content/chapters/4-becoming-an-elf-lord.mdx +++ b/src/content/chapters/4-becoming-an-elf-lord.mdx @@ -76,7 +76,7 @@ The [section header table](https://refspecs.linuxbase.org/elf/gabi4+/ch4.sheader For example, the program header table can specify a large swath of data to be loaded into memory together. That single `PT_LOAD` block might contain both code and global variables! There's no reason those have to be specified separately to *run* the program; the CPU just starts at the entry point and steps forward, accessing data when and where the program requests it. However, software like a debugger for *analyzing* the program needs to know exactly where each area starts and ends, otherwise it might try to decode some text that says "hello" as code (and since that isn't valid code, explode). This information is stored in the section header table. -While it's usually included, the section header table is actually optional. ELF files can run perfectly well with the section header table completely removed, and developers who want to hide what their code does will sometimes intentionally strip or mangle the section header table from their ELF binaries to [make them harder to decode](https://binaryresearch.github.io/2019/09/17/Analyzing-ELF-Binaries-with-Malformed-Headers-Part-1-Emulating-Tiny-Programs.html). +While it's usually included, the section header table is actually optional. ELF files can run perfectly well with the section header table completely removed, and developers who want to hide what their code does will sometimes intentionally strip or mangle the section header table from their ELF binaries to [make them harder to decode](https://web.archive.org/web/20230819125954/https://binaryresearch.github.io/2019/09/17/Analyzing-ELF-Binaries-with-Malformed-Headers-Part-1-Emulating-Tiny-Programs.html). Each section has a name, a type, and some flags that specify how it's intended to be used and decoded. Standard names usually start with a dot by convention. The most common sections are: