title: why does not readelf report right sizes?
body: <p>I have a Linux executable file (which is an ELF file) called <code>a.out</code>.</p>
  <p>I use</p>
  <pre><code>readelf -hl a.out
  </code></pre>
  <p>and get output</p>
  <pre><code>ELF Header:
    Magic:   7f 45 4c 46 02 01 01 03 00 00 00 00 00 00 00 00 
    Class:                             ELF64
    Data:                              2's complement, little endian
    Version:                           1 (current)
    OS/ABI:                            UNIX - GNU
    ABI Version:                       0
    Type:                              EXEC (Executable file)
    Machine:                           Advanced Micro Devices X86-64
    Version:                           0x1
    Entry point address:               0x4008e0
    Start of program headers:          64 (bytes into file)
    Start of section headers:          910680 (bytes into file)
    Flags:                             0x0
    Size of this header:               64 (bytes)
    Size of program headers:           56 (bytes)
    Number of program headers:         6
    Size of section headers:           64 (bytes)
    Number of section headers:         33
    Section header string table index: 30
  
  Program Headers:
    Type           Offset             VirtAddr           PhysAddr
                   FileSiz            MemSiz              Flags  Align
    LOAD           0x0000000000000000 0x0000000000400000 0x0000000000400000
                   0x00000000000c9be6 0x00000000000c9be6  R E    200000
    LOAD           0x00000000000c9eb8 0x00000000006c9eb8 0x00000000006c9eb8
                   0x0000000000001c98 0x0000000000003550  RW     200000
    NOTE           0x0000000000000190 0x0000000000400190 0x0000000000400190
                   0x0000000000000044 0x0000000000000044  R      4
    TLS            0x00000000000c9eb8 0x00000000006c9eb8 0x00000000006c9eb8
                   0x0000000000000020 0x0000000000000050  R      8
    GNU_STACK      0x0000000000000000 0x0000000000000000 0x0000000000000000
                   0x0000000000000000 0x0000000000000000  RW     10
    GNU_RELRO      0x00000000000c9eb8 0x00000000006c9eb8 0x00000000006c9eb8
                   0x0000000000000148 0x0000000000000148  R      1
  
   Section to Segment mapping:
    Segment Sections...
     00     .note.ABI-tag .note.gnu.build-id .rela.plt .init .plt .text __libc_freeres_fn __libc_thread_freeres_fn .fini .rodata __libc_subfreeres __libc_atexit .stapsdt.base __libc_thread_subfreeres .eh_frame .gcc_except_table 
     01     .tdata .init_array .fini_array .jcr .data.rel.ro .got .got.plt .data .bss __libc_freeres_ptrs 
     02     .note.ABI-tag .note.gnu.build-id 
     03     .tdata .tbss 
     04     
     05     .tdata .init_array .fini_array .jcr .data.rel.ro .got
  </code></pre>
  <p>According to the above output, this ELF file should have size</p>
  <pre><code>ELF header size : 64
    +
  Section headers : 64*33 = 2112
    +
  Program headers : 56*6 = 336
    +
  Segments : 834090 = 0x00000000000c9be6 + 0x0000000000001c98 + 0x0000000000000044 + 0x0000000000000020 + 0x0000000000000148 
  
  = 64 + 2112 + 336 + 834090 = 836602
  </code></pre>
  <p>However, <code>/bin/ls</code> reports file size 912792.
  where are the <code>912792 - 836602 = 76190</code> bytes?
  which parts did I forget to count?</p>
  <h1>UPDATE</h1>
  <p>according to @Jonathon Reinhart, I re count the size using section sizes instead of segment size by</p>
  <pre><code>echo &quot;print 0x020 + 0x024 + 0x0f0 + 0x01a + 0x0a0 + 0x09eda4 + 0x02529 + 0x0de + 0x09 + 0x01d320 + 0x050 + 0x08 + 0x01 + 0x08 + 0x0b04c + 0x0b2 + 0x020 + 0x010 + 0x010 + 0x08 + 0x0e4 + 0x010 + 0x068 + 0x01ad0 + 0x023 + 0x0f18 + 0x0169 + 0x0b100 + 0x0685a&quot; | /usr/bin/python 
  </code></pre>
  <p>The section size values used above are extracted from the output of <code>readelf -S a.out</code> and the size of section type of &quot;NOBITS&quot; were not counted.</p>
  <p>The above code output <code>909459</code> which is bigger than segment size <code>834090</code>,
  however, the total size is still not equal to the file size.</p>
  <pre><code>64 + 2112 + 336 + 909459 = 911971 != 912792
  </code></pre>
  <p>still missing <code>912792 - 911971 = 821</code> bytes.</p>
  <h1>update2 [solved]</h1>
  <p>according to the comment, I have test the offset. The result tells me that the adding pad does exist.</p>