> For the complete documentation index, see [llms.txt](https://davidjosearaujo.gitbook.io/notes-mcs/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://davidjosearaujo.gitbook.io/notes-mcs/reverse-engineering/binary-analysis/what-is-inside-an-object-file.md).
# What is inside an Object File?
An Object File contains information required to execute a program (not only code).
* May not include all implementations, as this can be dynamically loaded.
Information is kept in sections, which are processed differently. Some are:
* **`.rodata`**: read-only data, containing strings.
* **`.got`**: Global Offset Table - maps symbols to memory locations (offsets).
* **`.plt`**: Procedure Linkage Table – uses the PLT to transfer execution to the correct location of a symbol, dealing with external symbols and fixing the GOT.
* **`.bss`**: **Block Starting Symbol** – contains uninitialized variables.
* **`.dynsym`**: List of symbols in allocatable memory.
* … many others:
* To read sections: `readelf -S hello`
* To dump all code: `objdump -M intel -d hello`
## How are objects loaded?
The file is **split** according to existing **sections**. Each is loaded at a different location (with different access attributes).
**Libraries are also mapped** in the program address space. All code from libraries is present.
**The stack** grows **downwards**, **heap** grows **upwards**. On modern OS, growth may be limited, not on microcontrollers.
An interpreter is required to set up the binary in memory.
* `ld-Linux.so` or `ntdll.dll`
* `readelf -p .interp filename`
* Will handle relocations, and resolve required symbols.
* If lazy-loading is used, relocation is done when the symbol is first used
