daan@ubuntu:~/hax/fmt/dtor$ gcc test.c -fno-stack-protector -z execstack -ggdb -o test

daan@ubuntu:~/hax/fmt/dtor$ readelf -t ./test | grep -A2 .dtors
  [19] .dtors
       PROGBITS        08049f1c 000f1c 000008 00   0   0  4
       [00000003]: WRITE, ALLOC

daan@ubuntu:~/hax/fmt/dtor$ gdb -q ./test
Reading symbols from /home/daan/hax/fmt/dtor/test...done.
(gdb) list
1	main() {
2		unsigned int *dtors = (unsigned int *) 0x08049f20;
3		*dtors = 0x41414141;
4	}

(gdb) x/x 0x08049f20
0x8049f20 <__DTOR_END__>:	0x00000000

(gdb) run
Program received signal SIGSEGV, Segmentation fault.
0x080483c4 in main () at test.c:3
3		*dtors = 0x41414141;

(gdb) x/i 0x080483c4
=> 0x80483c4 <main+16>:	movl   $0x41414141,(%eax)

(gdb) i r eax
eax            0x8049f20	134520608

(gdb) x/x 0x08049f20
0x8049f20 <__DTOR_END__>:	0x00000000

(gdb) maintenance info sections
...
    0x8049f1c->0x8049f24 at 0x00000f1c: .dtors ALLOC LOAD DATA HAS_CONTENTS
...

(gdb) bt
#0  0x080483c4 in main () at test.c:3

(gdb) i f
Stack level 0, frame at 0xbffff340:
 eip = 0x80483c4 in main (test.c:3); saved eip 0xb7e65113
 source language c.
 Arglist at 0xbffff338, args:
 Locals at 0xbffff338, Previous frame's sp is 0xbffff340
 Saved registers:
  ebp at 0xbffff338, eip at 0xbffff33c