title: Locating ELF shared library exports at runtime
body: <p>It is possible to extract exported symbols of a loaded shared library using only its memory image?</p>
  
  <p>I'm talking about the symbols listed in <strong>.dynsym</strong> section. As I understand, we can go this way:</p>
  
  <ol>
  <li><p><strong>Locate the base address of the library.</strong><br>For example, by reading <code>/proc/&lt;pid&gt;/maps</code> it is possible to find memory areas which are mapped from the library on disk, and then we can look for ELF magic bytes to find the ELF header which gives us the base address.</p></li>
  <li><p><strong>Find the PT_DYNAMIC segment from the program headers.</strong><br>Parse the ELF header, then iterate over the program headers to find the segment which contains the <strong>.dynamic</strong> section.</p></li>
  <li><p><strong>Extract the location of the dynamic symbol table.</strong><br>Iterate over the ElfN_Dyn structs to find the ones with d_tags DT_STRTAB and DT_SYMTAB. These will give us addresses of the string table (with symbol names) and the dynamic symbol table itself.</p></li>
  </ol>
  
  <p>And this is where I stumbled. <strong>.dynamic</strong> section has a tag for the size of the string table (DT_STRSZ), but there is no indication of the symbol table size. It only contains the size of a single entry (DT_SYMENT). How can I retrieve the number of symbol entries in the table?</p>
  
  <p>It should be possible to infer that from the size of the <strong>.dynsym</strong> section, but ELF files are represented as segments in memory. The section table is not required to be loaded into memory and can only be (reliably) accessed by reading the corresponding file.</p>
  
  <p>I believe it is possible because the dynamic linker has to know the size of the symbol table. However, the dynamic loader may have stored it somewhere when the file had been loaded, and the linker is just using the cached value. Though it seems somewhat stupid to load the symbol table into memory, but to not load a handful of bytes with its size alongside.</p>