Question

Just to give you some context, here s what I m trying to achieve: I am embedding a const char* in a shared object file in order to have a version string in the .so file itself. I am doing data analysis and this string enables me to let the data know which version of the software produced it. This all works fine.

我在试图直接阅读图书馆的插播节目时,会遇到这个问题。我试图使用

nm libSMPselection.so | grep _version_info

并且

000000000003d968 D __SMPselection_version_info

this is all fine and as expected (the char* is called _SMPselection_version_info). However I would have expected to now be able to open the file, seek to 0x3d968 and start reading my string, but all I get is garbage.

当我打开案卷并简单地搜查行踪的内容时(我知道它是如何开始的),我可以找到地址是0x2e0b4。在该地址,零按期终止。 (我现在使用这种方法)

我不是一个计算机科学家。请允许我向我解释,如果Nm isn t正确,或以不同方式显示的象征价值没有文号,那么该数值究竟是什么?

(我与SOSX一道在澳门工作的方式10.7)

Answer 1

没有人提出最简单的方式: 具有活力的双筒(把其名称放在指挥线上)却把你的文号(或者也可以在指挥线上拿到)推给它,以扼杀点子,并印刷它。

Answer 2

假定其ELF或类似结构的双轨制,你必须考虑到装满的地址,该地址受ELF头盔的物品的影响。

在您的双亲上使用<条码>objdump-Fd,你也可以有左轮机显示一个象征的准确文档。

利用<条码>objdump -x,你可以找到这一载荷地址,通常为标准行距0x400 000。

您必须仔细研究的下一个事项是,看看其间接扼杀,你能最容易地使用<条码>objdump -g。在通过<条形码>objdump-Fd的位置产出中,如果发现扼杀是一种间接扼杀,你将不发现这种说法,而是会发现地址。从这一点来看,你需要再减去装货人地址。请允许我向各位介绍我的双亲之一:

objdump -Fd BIN | grep VersionString
  45152f:       48 8b 1d 9a df 87 00    mov    0x87df9a(%rip),%rbx        # ccf4d0 <acVersionString> (File Offset: 0x8cf4d0)

objdump -x BIN
...
LOAD off    0x0000000000000000 vaddr 0x0000000000400000 paddr 0x0000000000400000 align 2**12
...

因此,我们在档案中看着0x8cf4d0,并在主食中发现:

008C:F4D0 D8 C1 89 00  00 00 00 00  01 00 00 00  FF FF FF FF

因此,我们在那里带走了0x89C1D8,下了0x400 000,有0x49c1d8,当我们看在那里时,我们发现:

0049:C1D0 FF FF 7F 7F  FF FF 7F FF  74 72 75 6E  6B 5F 38 30
0049:C1E0 34 33 00 00  00 00 00 00  00 00 00 00  00 00 00 00

Which means "trunk_8043".

YMMV, 特别是在它的一些其他档案格式时,但这是这些事情结构的总体方式,其中有许多战争和细节偏离了特殊情况。

Answer 3

On Linux you have the strings command which help you extract strings from binaries.

rel=“nofollow”http://linux.about.com/library/cmd/blcmdl1_strings.htm

在“HPUX”(我也在其他“Unix”式射线器中认为)中,有类似的指挥权称为“什么”。它只从“@(#)”开始,但如果你控制扼杀内容,这不是一个问题。

Answer 4

Why would you expect the offset displayed by nm to be the offset in the .so file? .so files are not simply memory images; they contain a lot of other information as well, and have a more or less complicated format. Under Unix (at least under most Unices), shared objects use the elf format. To find the information, you will have to interpret the various fields in the file, to find where the symbol you want is located, in which segment, and where that segment starts in the file. (You can probably find a library which will simplify reading them.)

Also, if you are correct in saying that you ve embedded a char const*, i.e. that your code contained something like:

char const* version = "...";

then the address or offset of version is the address or offset of the pointer, not the string data it is pointed to. Defining it as:

char const version[] = "...";

解决这个问题。

Finally, the simplest solution might be to just make sure that the string has some highly identifiable pattern, and scan the entire file linearly looking for this pattern.

友情链接