Why doesn't `strip` remove section headers from ELF executables?

Question

A minimal ELF executable only requires the ELF header and at least one program header in order to be functional. However, when I run strip on a short executable, it decides not to throw out the section header table or the section strings section, keeping them around although they have no purpose (as far as I know) for the program's execution.

Is there a reason why these aren't removed by strip? Is there another utility which removes everything which isn't required for the executable to run? I've tried manually editing the code-golfing executable I was making to remove the section headers, and it appears to work fine, and be much smaller.

Solution

The documentation for GNU binutils strip alludes to the reason, but is not explicit, mentioning in the description of --only-keep-debug that

Note - the section headers of the stripped sections are preserved, including their sizes, but the contents of the section are discarded. The section headers are preserved so that other tools can match up the debuginfo file with the real executable, even if that executable has been relocated to a different address space.

That is, unless told to explicitly via the -R option, strip will retain section headers to help other programs (including gdb) do their job.

The page Correct use of the strip command (part of Reverse Engineering using the Linux Operating System) notes

Running the strip command on an executable is the most common program protection method. In its default operation, the strip command removes the symbol table and any debugging information from an executable. This is how it is typically used. However, there is still useful information that is not removed.

and goes on to enumerate several useful things that might be left behind — for analysis of a "stripped" executable.

In Learning Linux Binary Analysis, this is reiterated, commenting that section headers are normally only missing when someone has deliberately removed them, and that without section headers, gdb and objdump are nearly useless.

Comments

[Admin]

It isn't stripped probably because it may break some programs/runtimes