在剥离的 ELF 可执行文件中设置断点
我有一个 ELF 32 位动态链接、剥离文件，我希望对其进行调试。尝试在某个地址设置断点时，出现一条消息，提示符号表未加载。
我的问题是：
- 当您说 ELF 文件被
stripped时，到底发生了什么？ - 如何剥离 ELF 文件？
- 是否可以以某种方式重建符号表？
- 是否无法在 gdb 中对剥离的可执行文件设置断点？
I have an ELF 32-bit dynamically linked, stripped file which I wish to debug. While trying to set a breakpoint at an address a message saying that the symbol table is not loaded.
My questions are:
- When you say that an ELF file is
strippedwhat exactly is happening? - How do you strip an ELF file?
- Is it possible to reconstruct the symbol table somehow?
- Is it not possible to set breakpoints in gdb on a stripped executable?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（1）
剥离 ELF 是使用 gnu binutils 工具 strip 完成的，来自 strip 手册页：
当你说 ELF 文件被剥离时到底发生了什么？
剥离会从二进制文件中删除不必要的信息。这可能只是调试数据或未导出的符号。
如何剥离 ELF 文件？
您可以使用 strip 来剥离二进制文件，例如
strip -s yourLittleBinary- 这将用剥离版本替换文件。选项-s告诉 strip 删除所有符号。 Strip 可以通过多种方式进行操作。再次，从它的手册页：是否可以以某种方式重建符号表？
据我所知，这是不可能的。然而，可以在剥离之前从可执行文件创建一种映射文件，以便保留调试所需的信息。
是否无法在 gdb 中对剥离的可执行文件设置断点？
这是可能的。它只是一个可执行文件 - 去掉了它的符号名称。然而，由于没有符号，唯一剩下的就是在特定地址设置断点（除了为您提供地址 <-> 名称映射的映射文件之外）。但是，您可以在相关可执行文件使用的共享库的任何函数处设置断点。
关于映射文件
您可以使用 nm 实用程序从可执行文件创建映射文件：
这将转储所有符号、C++ 分解（选项 -C）并按数字排序（选项 -n）。
链接
这可能会给您一些想法：http://www.linuxsa.org.au /meetings/reveng-0.2.pdf
GNU binutils 文档： http://sourceware.org/binutils/docs-2.21/binutils /index.html
GDB 文档：http://www.gnu.org/software/gdb/documentation/
Stripping ELFs is is done with the gnu binutils tool strip, from the strip man page:
When you say that an ELF file is stripped what exactly is happening?
Stripping removes not-essential information from the binary. That may be just the debug-data or not exported symbols.
How do you strip an ELF file?
You can strip a binary by using strip like
strip -s yourLittleBinary- which will replace the file with a stripped version. The option-stells strip to remove all symbols. Strip can operate in a number of ways. Again, from it's man page:Is it possible to reconstruct the symbol table somehow?
As far as I know, it is not possible. It is however possible to create a kind of map file from the executable before stripping, in order to retain the information needed for debugging.
Is it not possible to set breakpoints in gdb on a stripped executable?
It is possible. It's just an executable - stripped of it's symbol names. However, as there are no symbols the only thing that (apart from having a map file that provides you with an address <-> name mapping) remains is setting break points at specific addresses. You can however set break points at any function of shared libraries that the executable in question uses.
On map files
You can create a map file from an executable using the
nmutility:This will dump all symbols, C++-demangled (option -C) and sorted numerically (option -n).
Links
This might give you some ideas: http://www.linuxsa.org.au/meetings/reveng-0.2.pdf
GNU binutils docs: http://sourceware.org/binutils/docs-2.21/binutils/index.html
GDB documentation: http://www.gnu.org/software/gdb/documentation/