3

I need to extract the global variables from a compiled c program. What am I doing right now is using the Linux readelf command in order to get that information. In other words when I do:

  readelf.exe -w[i]  myFile.out      

I do that with readelf.exe a program that can be downloaded from here. because I am using windows and that is the only command that I need. On linux I will just open the console and do readelf -w[i] myFile.out

anyways when I execute that command I get something like:

 <1><86923>: Abbrev Number: 2 (DW_TAG_base_type)
    <86924>   DW_AT_name        : unsigned int  
    <86925>   DW_AT_encoding    : 7 (unsigned)
    <86927>   DW_AT_byte_size   : 4 
<1>..
...
... bla bla bla
... 
<1><870a1>: Abbrev Number: 12 (DW_TAG_variable)
    <870a2>   DW_AT_decl_file   : 25    
    <870a3>   DW_AT_decl_line   : 543   
    <870a5>   DW_AT_external    : 1 
    <870a6>   DW_AT_name        : NetBuf_ID_Ctr     // <------------------- First variable
    <870b4>   DW_AT_type        : <0x86923> 
    <870b8>   DW_AT_location    : 5 byte block: 3 ff f9 b 20    (DW_OP_addr: fff90b20)
 <1><870be>: Abbrev Number: 3 (DW_TAG_typedef)
    <870bf>   DW_AT_decl_file   : 26    
    <870c0>   DW_AT_decl_line   : 192   
    <870c2>   DW_AT_name        : NET_CONN_FAMILY   
    <870d2>   DW_AT_type        : <0x862f1> 
 <1><870d6>: Abbrev Number: 3 (DW_TAG_typedef)
    <870d7>   DW_AT_decl_file   : 26    
 ....

with that "tree" I am able to get all the global variables and the type. For example if you look at the first variable NetBuf_ID_Ctr we can see that we can obtain information about the type on the node <0x86923>. That node is somewhere in the tree! if you take a look that is actually the first node. The one that starts <1><86923>.... and if you see inside that node we know that the variable is an unsigned int with 4 bytes of size.


Now my question is When I use that readelf command I get enter image description here 192883 lines of text that I need to parse! This tree gives me way more information that what I need. If I look into the file with a hex editor this is what I see:

enter image description here

note that I was able to find the same variable NetBuf_ID_Ctr and next to it (highlighted) is it's address <0x86923>!

Is there some place on the internet that will guide me on how to construct the tree? the command readelf.exe takes .1 seconds to create the tree! It places it's output on a StreamReader that's why it is so fast. If I wish to place that StreamReader on memory converting it to a string that is where it takes so long.


Edit

In summary I will like to know how is the tree (output of readelf) constructed from myFile.out . I cannot figure out the pattern neither a place on the internet that explains how.

1 Answer 1

1
+100

Basically, the dwarf debug information in an ELF object file resides in the sections

  • .debug_aranges
  • .debug_frame
  • .debug_info
  • .debug_line
  • .debug_pubnames
  • .debug_pubtypes

The tree of dies is constructed by parsing the information in .debug_info which describes the relationships between the Debug Information Entries, (DIEs). How this information is stored is described in the DWARF standard which can be found here

From your question, it seems you want to dump all the global symbols as fast as you can. If you want to do this from your own program, you could use libdwarf to parse the contents of .debug_pubnames. This section contains sets of headers followed by a number of name, offset pairs. The names are the global names and the offset is the DIE's offset from the start of it's compilation unit. This can again be used by libdwarf to get more detailed information on it.

libdwarf can quite easily be compiled on windows, but you will also need libelf. See also this for a simpler explanation of the DWARF Debug Information Format

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.