Where is the import table in the ELF file?

Question

I found ".dynsym" in the String Table, got the index. Then I found a section called sh_name = index && sh_type = SHT_DYNSYM. So I got sh_offset = 464 and sh_size = 64. But in the attached figure, you can see that at offset 464 there are only zeros.

I believe that the import table starts at offset 528. Question: how to calculate%)

Answer 1

But in the attached figure, you can see that at offset 464 there are only zeros.

Incorrect: 01 , 20 , 29 , 12 , etc. are not “only zeros” the last time I checked.

I believe the import table starts at offset 528

No, it is not. For some reason, you expect to find the Microsoft PE style entry table in the ELF file. This is not true.

The equivalent of the import table in ELF is contained in two tables. One contains fixed-size Elf{32,64}_Sym :

 typedef struct { Elf32_Word st_name; /* Symbol name (string tbl index) */ Elf32_Addr st_value; /* Symbol value */ Elf32_Word st_size; /* Symbol size */ unsigned char st_info; /* Symbol type and binding */ unsigned char st_other; /* Symbol visibility */ Elf32_Section st_shndx; /* Section index */ } Elf32_Sym; 

and is contained in the .dynsym section.

Another table is contained in the .dynstr section (which in your file starts at offset 528) and has only rows (variable size) separated by the NUL .

.st_name in the first table refers to the offset in .dynstr .