When we run an executable, do all the sections get loaded into memory at once?

问题

So an executable contains of different sections and headers.

At the ELF Header we can see some metadata about them like the size of different headers, Starting point etc.

Are the different parts of an executable get loaded into memory all at once?

If yes, how / when it is defined and where we can see the information about that because the ELF Header doesn't seem to have any parameter in that matter.

Thanks in advance.

回答1:

With ELF binaries, sections are not what decides how the binary is loaded into memory. They are just useful metadata for debuggers and other tools and there doesn't need to be a correspondence between segments and sections and often multiple sections are subsumed under one segment. A binary can have no section header at all and still load fine.

What actually decides what is getting loaded and where are the program headers. Each program header describes one memory segment and contains the following information:

• the field p_type tells you what kind of information the program header contains. This is typically just PT_LOAD to mean “loadable segment.”
• the field p_offset tells you the offset from the beginning of the file where the segment resides. Note that in rare cases, this can lie beyond the end of the file.
• the field p_vaddr tells you the virtual address at which the segment is mapped. There is also p_paddr to specify a physical address, but it's generally unused.
• the field p_filesz tells you how long the segment is in the file.
• the field p_memsz tells you how long the segment is in memory. If this is more than the segment length in the file, the remainder is filled with zeroes.
• the field p_flags tells you if the segment is readable (PF_R), writable (PF_W), executable (PF_X) or some combination of these three. When loading a segment, the operating system uses these flags to set up write and executable protection.
• the field p_align tells you how the segment is aligned. This is not really important here.

When the operating system loads your binary or when the runtime link editor loads a shared object, it reads the program headers of your binary and loads or maps each segment in the order they appear. Once this is done, your program is executed.

You can get information about the program headers of a binary by running readelf -l binary.

来源：https://stackoverflow.com/questions/51960742/when-we-run-an-executable-do-all-the-sections-get-loaded-into-memory-at-once