Open mjhouse opened 1 year ago
The more common hash section used in modern ELF is DT_GNU_HASH, not DT_HASH as described above. DT_GNU_HASH includes a bloom filter and is significantly more complicated. Refer to the following pages for more information:
https://blogs.oracle.com/solaris/post/gnu-hash-elf-sections https://flapenguin.me/elf-dt-gnu-hash
Overview
NOT ACCURATE. SEE THIS COMMENT FOR MORE.
A hash table section is used to very quickly find a symbol by it's name. Given the name, the hash table can be used in an iterative way to find potential matching symbols until the symbol with the correct name is found.
The hash table is made up of:
To find a symbol:
x
bucket [ x % nbucket]
chain[x] = y
y
can be used as an index into the symbol table for the next matchy
can be used to access the next "chain" item:chain[y] = z
Reference
See: https://docs.oracle.com/cd/E23824_01/html/819-0690/chapter6-48031.html
Reference hash function (generated by GPT-4, so verify it):
Notes
sh_link
attribute in the section header