The documentation for GNU binutils strip
alludes to the reason, but is not explicit, mentioning in the description of --only-keep-debug
that
Note - the section headers of the stripped sections are preserved, including their sizes, but the contents of the section are discarded. The section headers are preserved so that other tools can match up the debuginfo file with the real executable, even if that executable has been relocated to a different address space.
That is, unless told to explicitly via the -R
option, strip
will retain section headers to help other programs (including gdb
) do their job.
The page Correct use of the strip command (part of Reverse Engineering using the Linux Operating System) notes
Running the strip
command on an executable is the most common program protection method. In its default operation, the strip
command removes the symbol table and any debugging information from an executable. This is how it is typically used. However, there is still useful information that is not removed.
and goes on to enumerate several useful things that might be left behind — for analysis of a "stripped" executable.
In Learning Linux Binary Analysis, this is reiterated, commenting that section headers are normally only missing when someone has deliberately removed them, and that without section headers, gdb
and objdump
are nearly useless.