2

This question already has an answer here:

Recently, I dumped my memory strings (just because I could) using sudo cat /dev/mem | strings. Upon reviewing this dump, I noticed some very interesting things:

.symtab
.strtab
.shstrtab
.note.gnu.build-id
.rela.text
.rela.init.text
.rela.text.unlikely
.rela.exit.text
.rela__ksymtab
.rela__ksymtab_gpl
.rela__kcrctab
.rela__kcrctab_gpl
.rela.rodata
.rodata.str1.8
.rela__mcount_loc
.rodata.str1.1
.rela__bug_table
.rela.smp_locks
.modinfo
__ksymtab_strings
.rela__tracepoints_ptrs
__tracepoints_strings
__versions
.rela.data
.data.unlikely
.rela__verbose
.rela__jump_table
.rela_ftrace_events
.rela.ref.data
.rela__tracepoints
.rela.gnu.linkonce.t6

These lines all seem to be related in some way: they are all (very) near each other in the memory, they all have similar .<name> prefixes, and they all seem to refer to each other.

What would cause these strings to appear, and why?

marked as duplicate by Thomas Dickey, cas, maxschlepzig, garethTheRed, PersianGulf Jun 26 '16 at 0:51

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

migrated from askubuntu.com Jun 24 '16 at 22:20

This question came from our site for Ubuntu users and developers.

  • 1
    Why not google some of these identifiers? Here is a bit of C source that contains a couple of them. – Jos Jun 24 '16 at 20:56
  • 1
    sudo strings /dev/mem would have save a cat... – jlliagre Jun 24 '16 at 23:42
  • @jlliagre How would I make PETA mad, then? – Kaz Wolfe Jun 24 '16 at 23:42
  • That's a valid point ;) – jlliagre Jun 24 '16 at 23:44
1

These look very much like section names from the Linux kernel. The ones prefixed by .rela contain relocation information for the named section, e.g. .rela.text is the relocation information for the text section (where kernel object code is stored).

Other sections of interest are:

  1. .modinfo - kernel module information
  2. .rela.__ksymtab - kernel symbol table relocation table
  3. .rela.data - kernel data section relocation table
  4. rodata.str1.1 - read only data section for strings

etcetera.

Running strings on /dev/mem will just find interesting strings in the systems physical memory; hence you managed to find some strings that are in the uncompressed vmlinuz linux kernel.

2

+1 to what @jos said above ("google it"). In this particular case you should remove the ".rela_" and "_gpl" parts. You'll find that these are kernel symbols. "rela" is an acronym for "relocation" and has to do with the ELF file format. These are all interesting topics and I encourage you to look into them further.

Not the answer you're looking for? Browse other questions tagged or ask your own question.