2

Trying to use objdump command in linux to display symbol table information in executable. i have tried a simple program below.

#include<stdio.h>
int global = 0;
typedef struct global_struct{
    int a;
    int c;
}global_struct;

global_struct gs;
int main()
{
    printf("%d\n",global);
    printf("%d\n",gs.a);
    return 0;
}

compiled with -g option in gcc compiler The output of objdump looks like

00000000004005b0 l     F .text  0000000000000000              __do_global_ctors_aux
0000000000000000 l    df *ABS*  0000000000000000              symboltable.c
0000000000600870 l     O .got.plt       0000000000000000              _GLOBAL_OFFSET_TABLE_
00000000006006ac l       .ctors 0000000000000000              __init_array_end
00000000006006ac l       .ctors 0000000000000000              __init_array_start
00000000006006d8 l     O .dynamic       0000000000000000              _DYNAMIC
0000000000600898  w      .data  0000000000000000              data_start
00000000006008b4 g     O .bss   0000000000000008              gs
0000000000000000       F *UND*  0000000000000000              printf@@GLIBC_2.2.5
0000000000400510 g     F .text  0000000000000002              __libc_csu_fini
00000000004003e0 g     F .text  0000000000000000              _start
0000000000000000  w      *UND*  0000000000000000              __gmon_start__
0000000000000000  w      *UND*  0000000000000000              _Jv_RegisterClasses
00000000004005e8 g     F .fini  0000000000000000              _fini
0000000000000000       F *UND*  0000000000000000              __libc_start_main@@GLIBC_2.2
00000000006008b0 g     O .bss   0000000000000004              global
00000000004005f8 g     O .rodata        0000000000000004              _IO_stdin_used
0000000000600898 g       .data  0000000000000000              __data_start
0000000000400600 g     O .rodata        0000000000000000              .hidden __dso_handle
00000000006006c8 g     O .dtors 0000000000000000              .hidden __DTOR_END__
0000000000400520 g     F .text  0000000000000089              __libc_csu_init
000000000060089c g       *ABS*  0000000000000000              __bss_start
00000000006008c0 g       *ABS*  0000000000000000              _end

My requirement is gs being C structure, I want to know the data members of gs{a,b}. How can i know structure member details from object files. Thanks for your support

1
  • 1
    You need to understand and be able to read the debug information in the object/executable file. GCC uses the DWARF format, and should place these in special sections with the debug_ prefix. Commented Sep 4, 2014 at 13:30

2 Answers 2

1

Structure member details are not detailed in the object file. The object file will only have enough memory allocated to hold the struct and an offset telling the linker where to find it.

The compiler knows at compile time at which offsets from the base struct pointer to find the members and hard codes those into the program text on each use.

2
  • Generally debuggers(GDB for example) is able to find structure members details. do you have idea as to how they are doing that. please share it if u know. Commented Sep 4, 2014 at 13:35
  • @user2095966 When you compile with -g (debugging symbols) then your compiler will inserts special debugging information into the binary. It's generally not part of the executable itself, but put into a special section within the binary's static data or as a separate file (e.g. Mach-O DSYM files). This information can only really be interpreted by a compatible debugger. That sort of debugging info normally will also only contain relative member offsets relative to the struct base pointer.
    – Sergey L.
    Commented Sep 4, 2014 at 13:38
0

If you passed -g to gcc when building the program, it should have DWARF debug information compiled in:

$ objdump -t prog | grep debug
0000000000000000 l    d  .debug_aranges 0000000000000000              .debug_aranges
0000000000000000 l    d  .debug_info    0000000000000000              .debug_info
0000000000000000 l    d  .debug_abbrev  0000000000000000              .debug_abbrev
0000000000000000 l    d  .debug_line    0000000000000000              .debug_line
0000000000000000 l    d  .debug_str     0000000000000000              .debug_str

Then you can read it with objdump:

$ objdump --dwarf=info prog
[...]
 <1><65>: Abbrev Number: 5 (DW_TAG_base_type)
    <66>   DW_AT_byte_size   : 4
    <67>   DW_AT_encoding    : 5        (signed)
    <68>   DW_AT_name        : int
[...]
 <1><2f8>: Abbrev Number: 8 (DW_TAG_structure_type)
    <2f9>   DW_AT_name        : (indirect string, offset: 0x22f): global_struct
    <2fd>   DW_AT_byte_size   : 8
    <2fe>   DW_AT_decl_file   : 1
    <2ff>   DW_AT_decl_line   : 3
    <300>   DW_AT_decl_column : 16
    <301>   DW_AT_sibling     : <0x31c>
 <2><305>: Abbrev Number: 17 (DW_TAG_member)
    <306>   DW_AT_name        : a
    <308>   DW_AT_decl_file   : 1
    <309>   DW_AT_decl_line   : 4
    <30a>   DW_AT_decl_column : 9
    <30b>   DW_AT_type        : <0x65>
    <30f>   DW_AT_data_member_location: 0
 <2><310>: Abbrev Number: 17 (DW_TAG_member)
    <311>   DW_AT_name        : c
    <313>   DW_AT_decl_file   : 1
    <314>   DW_AT_decl_line   : 5
    <315>   DW_AT_decl_column : 9
    <316>   DW_AT_type        : <0x65>
    <31a>   DW_AT_data_member_location: 4
 <2><31b>: Abbrev Number: 0
 <1><31c>: Abbrev Number: 2 (DW_TAG_typedef)
    <31d>   DW_AT_name        : (indirect string, offset: 0x22f): global_struct
    <321>   DW_AT_decl_file   : 1
    <322>   DW_AT_decl_line   : 6
    <323>   DW_AT_decl_column : 2
    <324>   DW_AT_type        : <0x2f8>
[...]

Here we can see that global_struct's DIE (Debug Information Entry) has two leaves (two DW_TAG_members, look at <2> prefixes which I believe it level in the tree). The members are called a and c. Both of the members reference type 0x65, which is defined above as a signed int.

A good place to learn more about DWARF is this official tutorial: http://www.dwarfstd.org/doc/Debugging%20using%20DWARF-2012.pdf

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.