How to View Function Names and Parameters Contained in an Elf File

How can I view function names and parameters contained in an ELF file?

This should print all defined symbols within your object file or library.

nm -C --defined-only file.o

nm has quite a lot of options that you could use to filter out the symbols like -g for displaying only global symbols, -l for printing the line number (if you had used gcc -g to enable debug symbols) and so on.

If you have an ELF format binary (looks to be your case), you could also use readelf

readelf -Ws file.o

The column number 8 in this output contains the symbol name which is of interest. You could use c++filt to demangle the name:

readelf -Ws file.o | awk '{print $8}' | c++filt

Ways to find all function definitions in a elf binary

how can I easily dump all function body

objdump -d xxx.so

How would you list the available functions etc contained within a compiled library?

You can use the nm command to list the symbols in static libraries.

nm -g -C <libMylib.a>

Find function's start offset in ELF

Generally yes, if you can parse the ELF file directly or combine output from tools like objdump and readelf.

More specific: You can get the offset and virtual address of your .text section with 'readelf -S file' - write those down.
Further you can list symbols with 'readelf -s file', as long your executable is not stripped, and your function is visible (not static or in an anonymous namespace) then you should find your function and the virtual address of it.

Thus you can calculate the offset via

fn symbol offset = fn symbol VA - .text VA + .text offset

Thats assuming you want to do it "offline" with common tools. Its more difficult if you dont have access to the unstripped ELF file, and since only a part of the ELF File remains in memory, probably not possible without adding some information with "offline" tricks.

How to list up variables assigned to a specific section in an elf file?

Every symbol has the section index to which it belongs in the Ndx column.

To find all symbols matching section 18, do this:

readelf -Ws vmlinux | cut -c60- | grep ' 18 '

Reading the contents of an ELF section(programmatically)

To extract .text section you need to copy 0x182 (Size) bytes starting from 0x440 (Offset) address in your binary file.

Ignore 0x400440 (Address) value, it has nothing to do with file addresses, it's address in RAM memory where your .text section will be copied by loader. From ELF format specification:

sh_addr: If the section will appear in the memory image of a process, this member gives the
address at which the section’s first byte should reside. Otherwise, the member contains 0.

Align value is actually decimal, not hexadecimal. So it's 16, not 0x16. Alignment means that section address must be multiple of 16 (bytes).


You can verify all this, exploring the binary by yourself. First, observe disassemble of your binary:

$ objdump -D your-file | less

Find where .text starts and then look at .text section data. Now just make a dumb hexdump operation:

$ hexdump -C your-file | less

Now find the Offset address and look at bytes starting from this address. You will find out they are the same bytes as from disassembled .text section.

Conclusion: you need to use Offset value (from readelf output) when working with your file, not Address value.

given a function identifier, is there a command line program or a library function providing the address as stored in the elf file

You could use libelf.

Alternatively, this question and answer shows how to do what nm does.

You could easily modify the code there to go in reverse: iterate over all symbols until you find the right symbol name, then return the address of that symbol.

If you need to perform lookups over multiple symbol names, you could of course iterate over all symbols once, and build a name -> address map, so subsequent lookups are fast.



Related Topics



Leave a reply



Submit