objdump与readelf.docx

1、objdump与readelfobjdump与readelf 对比objdump与readelfobjdump和readelf都可以用来查看二进制文件的一些内部信息. 区别在于objdump借助BFD而更加通用一些, 可以应付不同文件格式, readelf则并不借助BFD, 而是直接读取ELF格式文件的信息, 按readelf手册页上所说, 得到的信息也略细致一些. 几个功能对比. 1. 反汇编代码查看源代码被翻译成的汇编代码, 大概有3种方法, 1) 通过编译器直接从源文件生成, 如gcc -S 2) 对目标代码反汇编, 一种是静态反汇编, 就是使用objdump3) 另外一种就是对运行时的

2、代码反汇编, 一般通过gdbreadelf并不提供反汇编功能. objdump可以指定反汇编哪个节, 一般只有对包含指令的节反汇编才有意义. 而对于一些其他的类型的节, objdump也可以将特殊节的数据以解析后的形式呈现出来, 例如对于.plt, 输出如下: qtlcourier lib$ objdump -d -j .plt libfoobar.so libfoobar.so: file format elf32-i386Disassembly of section .plt:000003a4 <_gmon_start_plt-0x10>: 3a4: ff b3 04 00 0

3、0 00 pushl 0x4(%ebx) 3aa: ff a3 08 00 00 00 jmp *0x8(%ebx) 3b0: 00 00 add %al,(%eax) .000003b4 <_gmon_start_plt>: 3b4: ff a3 0c 00 00 00 jmp *0xc(%ebx) 3ba: 68 00 00 00 00 push $0x0 3bf: e9 e0 ff ff ff jmp 3a4 <_init+0x18>000003c4 <cosplt>: 3c4: ff a3 10 00 00 00 jmp *0x10(%ebx) 3c

4、a: 68 08 00 00 00 push $0x8 3cf: e9 d0 ff ff ff jmp 3a4 <_init+0x18>000003d4 <fwriteplt>: 3d4: ff a3 14 00 00 00 jmp *0x14(%ebx) 3da: 68 10 00 00 00 push $0x10 3df: e9 c0 ff ff ff jmp 3a4 <_init+0x18>000003e4 <fprintfplt>: 3e4: ff a3 18 00 00 00 jmp *0x18(%ebx) 3ea: 68 18 00

5、00 00 push $0x18 3ef: e9 b0 ff ff ff jmp 3a4 <_init+0x18>000003f4 <_cxa_finalizeplt>: 3f4: ff a3 1c 00 00 00 jmp *0x1c(%ebx) 3fa: 68 20 00 00 00 push $0x20 3ff: e9 a0 ff ff ff jmp 3a4 <_init+0x18>2. 显示relocation节的条目-r参数显示elf文件的类型为REL的节的信息, 使用-S参数可以列出elf文件的所有节的信息, 其中也就包括了REL节. 对于可重定

6、位文件两者显示条目一致, 最重要的offset和type以及Sym.Name都有. 下面是两者输出的对比. qtlcourier lib$ readelf -r bar.o Relocation section .rel.text at offset 0x4bc contains 6 entries: Offset Info Type Sym.Value Sym. Name00000008 00000b02 R_386_PC32 00000000 _i686.get_pc_thunk.bx0000000e 00000c0a R_386_GOTPC 00000000 _GLOBAL_OFFSET

7、_TABLE_00000025 00000d04 R_386_PLT32 00000000 cos0000002e 00000e03 R_386_GOT32 00000000 stdout00000044 00000509 R_386_GOTOFF 00000000 .rodata00000050 00000f04 R_386_PLT32 00000000 fprintfqtlcourier lib$ objdump -r bar.o bar.o: file format elf32-i386RELOCATION RECORDS FOR .text:OFFSET TYPE VALUE 0000

8、0008 R_386_PC32 _i686.get_pc_thunk.bx0000000e R_386_GOTPC _GLOBAL_OFFSET_TABLE_00000025 R_386_PLT32 cos0000002e R_386_GOT32 stdout00000044 R_386_GOTOFF .rodata00000050 R_386_PLT32 fprintf对于共享库, qtlcourier lib$ readelf -r libfoobar.so Relocation section .rel.dyn at offset 0x334 contains 6 entries: Of

9、fset Info Type Sym.Value Sym. Name00001608 00000008 R_386_RELATIVE 00001704 00000008 R_386_RELATIVE 000016d4 00000106 R_386_GLOB_DAT 00000000 _gmon_start_000016d8 00000206 R_386_GLOB_DAT 00000000 _Jv_RegisterClasses000016dc 00000606 R_386_GLOB_DAT 00000000 stdout000016e0 00000706 R_386_GLOB_DAT 0000

10、0000 _cxa_finalizeRelocation section .rel.plt at offset 0x364 contains 5 entries: Offset Info Type Sym.Value Sym. Name000016f0 00000107 R_386_JUMP_SLOT 00000000 _gmon_start_000016f4 00000307 R_386_JUMP_SLOT 00000000 cos000016f8 00000407 R_386_JUMP_SLOT 00000000 fwrite000016fc 00000507 R_386_JUMP_SLO

11、T 00000000 fprintf00001700 00000707 R_386_JUMP_SLOT 00000000 _cxa_finalizeqtlcourier lib$ objdump -R libfoobar.so libfoobar.so: file format elf32-i386DYNAMIC RELOCATION RECORDSOFFSET TYPE VALUE 00001608 R_386_RELATIVE *ABS*00001704 R_386_RELATIVE *ABS*000016d4 R_386_GLOB_DAT _gmon_start_000016d8 R_3

12、86_GLOB_DAT _Jv_RegisterClasses000016dc R_386_GLOB_DAT stdout000016e0 R_386_GLOB_DAT _cxa_finalize000016f0 R_386_JUMP_SLOT _gmon_start_000016f4 R_386_JUMP_SLOT cos000016f8 R_386_JUMP_SLOT fwrite000016fc R_386_JUMP_SLOT fprintf00001700 R_386_JUMP_SLOT _cxa_finalize有上面可以看出, readelf的显示分节, 而objdump则将两个节

13、合在一起. readelf的显示更加清晰一些. 3. 显示动态重定位条目(或者可以认为是动态链接相关的重定位条目)(按objdump的man page说明, 只对dynamic object有效, 如某些类型的共享库)readelf和objdump等价的命令为readelf -D -r file和objdump -R file. 对readelf使用-r和-D -r的区别, 对于共享库在于数据的呈现方式略有不同. 这两种都将数据解析后呈现出来. 前者显示的是相对于基地址的偏移, 后者则显示绝对偏移量. 前者显示条目数, 后者显示字节数. 两者输出对比: qtlcourier lib$ read

14、elf -D -r libfoobar.so REL relocation section at offset 0x334 contains 48 bytes: Offset Info Type Sym.Value Sym. Name00001608 00000008 R_386_RELATIVE 00001704 00000008 R_386_RELATIVE 000016d4 00000106 R_386_GLOB_DAT 00000000 _gmon_start_000016d8 00000206 R_386_GLOB_DAT 00000000 _Jv_RegisterClasses00

15、0016dc 00000606 R_386_GLOB_DAT 00000000 stdout000016e0 00000706 R_386_GLOB_DAT 00000000 _cxa_finalizePLT relocation section at offset 0x364 contains 40 bytes: Offset Info Type Sym.Value Sym. Name000016f0 00000107 R_386_JUMP_SLOT 00000000 _gmon_start_000016f4 00000307 R_386_JUMP_SLOT 00000000 cos0000

16、16f8 00000407 R_386_JUMP_SLOT 00000000 fwrite000016fc 00000507 R_386_JUMP_SLOT 00000000 fprintf00001700 00000707 R_386_JUMP_SLOT 00000000 _cxa_finalizeqtlcourier lib$ objdump -R libfoobar.so libfoobar.so: file format elf32-i386DYNAMIC RELOCATION RECORDSOFFSET TYPE VALUE 00001608 R_386_RELATIVE *ABS*

17、00001704 R_386_RELATIVE *ABS*000016d4 R_386_GLOB_DAT _gmon_start_000016d8 R_386_GLOB_DAT _Jv_RegisterClasses000016dc R_386_GLOB_DAT stdout000016e0 R_386_GLOB_DAT _cxa_finalize000016f0 R_386_JUMP_SLOT _gmon_start_000016f4 R_386_JUMP_SLOT cos000016f8 R_386_JUMP_SLOT fwrite000016fc R_386_JUMP_SLOT fpri

18、ntf00001700 R_386_JUMP_SLOT _cxa_finalize另外有必要说明的是如果对可重定位文件(.o文件)应用这两个命令是无效的, 错误提示如下: qtlcourier lib$ readelf -D -r bar.oThere are no dynamic relocations in this file.qtlcourier lib$ objdump -R bar.obar.o: file format elf32-i386objdump: bar.o: not a dynamic objectobjdump: bar.o: Invalid operation4.

19、显示节信息: readelf -S和objdump -h对于可重定位文件, objdump -h不能显示.rel开头的节和.shstrtab, .symtab, .strtab. 而readelf的显示有一个.group节, 其内容为节的group, 可以用-g参数查看. 输出如下: qtlcourier lib$ readelf -S bar.oThere are 13 section headers, starting at offset 0x150:Section Headers: Nr Name Type Addr Off Size ES Flg Lk Inf Al 0 NULL 00

20、000000 000000 000000 00 0 0 0 1 .group GROUP 00000000 000034 000008 04 11 11 4 2 .text PROGBITS 00000000 00003c 00005c 00 AX 0 0 4 3 .rel.text REL 00000000 0004bc 000030 08 11 2 4 4 .data PROGBITS 00000000 000098 000000 00 WA 0 0 4 5 .bss NOBITS 00000000 000098 000000 00 WA 0 0 4 6 .rodata PROGBITS

21、00000000 000098 00000e 00 A 0 0 1 7 .comment PROGBITS 00000000 0000a6 00002e 00 0 0 1 8 .text._i686.get_ PROGBITS 00000000 0000d4 000004 00 AXG 0 0 1 9 .note.GNU-stack PROGBITS 00000000 0000d8 000000 00 0 0 1 10 .shstrtab STRTAB 00000000 0000d8 000075 00 0 0 1 11 .symtab SYMTAB 00000000 000358 00011

22、0 10 12 10 4 12 .strtab STRTAB 00000000 000468 000053 00 0 0 1Key to Flags: W (write), A (alloc), X (execute), M (merge), S (strings) I (info), L (link order), G (group), x (unknown) O (extra OS processing required) o (OS specific), p (processor specific)qtlcourier lib$ objdump -h bar.obar.o: file f

23、ormat elf32-i386Sections:Idx Name Size VMA LMA File off Algn 0 _i686.get_pc_thunk.bx 00000008 00000000 00000000 00000034 2*2 CONTENTS, READONLY, EXCLUDE, GROUP, LINK_ONCE_DISCARD 1 .text 0000005c 00000000 00000000 0000003c 2*2 CONTENTS, ALLOC, LOAD, RELOC, READONLY, CODE 2 .data 00000000 00000000 00

24、000000 00000098 2*2 CONTENTS, ALLOC, LOAD, DATA 3 .bss 00000000 00000000 00000000 00000098 2*2 ALLOC 4 .rodata 0000000e 00000000 00000000 00000098 2*0 CONTENTS, ALLOC, LOAD, READONLY, DATA 5 .comment 0000002e 00000000 00000000 000000a6 2*0 CONTENTS, READONLY 6 .text._i686.get_pc_thunk.bx 00000004 00

25、000000 00000000 000000d4 2*0 CONTENTS, ALLOC, LOAD, READONLY, CODE 7 .note.GNU-stack 00000000 00000000 00000000 000000d8 2*0 CONTENTS, READONLY对于共享库, objdump -h仍然不能显示.shstrtab, .symtab, .strtab三个节, 另外还有一个区别在于readelf从一个NULL类型的节开始, 而objdump的输出去掉了这个空的节. qtlcourier lib$ readelf -S libfoobar.so There are

26、 27 section headers, starting at offset 0x8f0:Section Headers: Nr Name Type Addr Off Size ES Flg Lk Inf Al 0 NULL 00000000 000000 000000 00 0 0 0 1 .gnu.hash GNU_HASH 000000b4 0000b4 000048 04 A 2 0 4 2 .dynsym DYNSYM 000000fc 0000fc 000110 10 A 3 1 4 3 .dynstr STRTAB 0000020c 00020c 0000b3 00 A 0 0

27、 1 4 .gnu.version VERSYM 000002c0 0002c0 000022 02 A 2 0 2 5 .gnu.version_r VERNEED 000002e4 0002e4 000050 00 A 3 2 4 6 .rel.dyn REL 00000334 000334 000030 08 A 2 0 4 7 .rel.plt REL 00000364 000364 000028 08 A 2 9 4 8 .init PROGBITS 0000038c 00038c 000017 00 AX 0 0 4 9 .plt PROGBITS 000003a4 0003a4

28、000060 04 AX 0 0 4 10 .text PROGBITS 00000410 000410 0001a4 00 AX 0 0 16 11 .fini PROGBITS 000005b4 0005b4 00001c 00 AX 0 0 4 12 .rodata PROGBITS 000005d0 0005d0 00001d 00 A 0 0 1 13 .eh_frame PROGBITS 000005f0 0005f0 000004 00 A 0 0 4 14 .ctors PROGBITS 000015f4 0005f4 000008 00 WA 0 0 4 15 .dtors

29、PROGBITS 000015fc 0005fc 000008 00 WA 0 0 4 16 .jcr PROGBITS 00001604 000604 000004 00 WA 0 0 4 17 .data.rel.ro PROGBITS 00001608 000608 000004 00 WA 0 0 4 18 .dynamic DYNAMIC 0000160c 00060c 0000c8 08 WA 3 0 4 19 .got PROGBITS 000016d4 0006d4 000010 04 WA 0 0 4 20 .got.plt PROGBITS 000016e4 0006e4

30、000020 04 WA 0 0 4 21 .data PROGBITS 00001704 000704 000004 00 WA 0 0 4 22 .bss NOBITS 00001708 000708 000010 00 WA 0 0 4 23 .comment PROGBITS 00000000 000708 000114 00 0 0 1 24 .shstrtab STRTAB 00000000 00081c 0000d2 00 0 0 1 25 .symtab SYMTAB 00000000 000d28 0003d0 10 26 45 4 26 .strtab STRTAB 000

31、00000 0010f8 0001d7 00 0 0 1Key to Flags: W (write), A (alloc), X (execute), M (merge), S (strings) I (info), L (link order), G (group), x (unknown) O (extra OS processing required) o (OS specific), p (processor specific)qtlcourier lib$ objdump -h libfoobar.so libfoobar.so: file format elf32-i386Sections:Idx Name Size VMA LMA File off Algn 0 .gnu.hash 00000048 000000b4 000000b4 000000b4 2*2 CONTENTS, ALLOC, LOAD, READONLY,