Clever Geek Handbook

To get the size of an ELF binary, what's the difference between size and ls?

The test is on 32-bit x86 Linux.

To get the size of some ELF binaries I've tried these two commands:

ls -la sha512sum
size sha512sum

But the point is that the output size is different:

ls -la sha512sum
-rwxrwxr-x 1 szw175 szw175 95856 Oct 10 07:50 sha512sum

 size sha512sum
 text      data     bss     dec     hex filename
 89644      488     452   90584   161d8 sha512sum

So my question is to estimate the size of the ELF binary, which method is more reliable? Why are these two methods different?

+3


source to share


2 answers


size(1)

specifies the sizes of the various sections in the file. ls(1)

indicates the number of bytes that the ELF file contains. They serve completely different purposes, and one of them is more "reliable" depends entirely on what you are going to do with the file.



+2


source


You may think that the elven file contains various information about loading and linking the program at runtime. All information provided as input (.text, .data, .bss, .rel. * Etc.) is stored in different sections of the elven file. This section is controlled by a section header table stored in binary somewhere.

You get the size of the content of the sections

size sha512sum

but if you want to get the total file size (which includes the elf-header, program header table, and section-header table along with the section content), then you will use



ls -la sha512sum

Please note that when the program is loaded (at any address, namely the base address), the contents of the sections are displayed at different offsets from the base address. The display may not be permanent, and the program execution time may be longer than the file size. Also note that some sections (like .bss containing only zeros) are not even stored in the file. The loader program maps the memory area and fills in zeros instead of copying zeros from the file. This saves a lot of disk space and reduces the file size (and therefore the time it takes to load the binary into memory).

Thus, the size of the memory image in the program can be larger than the file size.

0


source






More articles:


All Articles