EDIT: I am rephrasing entirely my original question as it was far from clear (it's non-clearness can be seen at the bottom!).
I am developing a RTOS where both the kernel and the applications must be mapped to very specific locations in memory. For example:
0x00000000:0x0000ffff: application #1
0x00010000:0x0000ffff: application #2
...
0xffff0000:0xffffffff: kernel
The applications (and the kernel) are developed (and compiled) separately. To merged everything into a single executable, the following process is used:
(Separately) Compile the kernel and the applications (stripped of any symbols).
(Through a script) Generate a linker script to relocate the kernel and the applications to the desired locations. To prevent any conflicts between sections' names, the generated linker script "renames" all sections of all applications (e.g. .app1.text, .app1.data, .app1.bss, ...).
Link using the previously generated linker script (i.e. merge all).
Question 1) Is it possible to replace steps #2 and #3 with something like the following process?
Relocate the object files of the kernel and the applications to the desired position.
Rename all symbols on the applications' object files (to prevent name clashes).
Merge all.
I'm trying to replace the generation of the linker script with some already available tools.
Step #1 should be possible through the creation of a position independent executable (I still have to investigate this).
Step #2 is possible through GNU objcopy.
For Step #3 I have no possible solution yet. If GNU ld is used, it uses some default linker script and the previous relocation is lost. If GNU gdb accepted archives generated from GNU ar the problem would be solved (I guess!).
Question 2) If the above process is possible, can it be applied to debugging information as well?
Step #1 should remain intact.
For step #2 I am not sure if debugging information gets renamed or not.
The problem with step #3 remains.
The original question follows:
I have a custom kernel and one or more applications and, I want to use
GDB to debug the entire system. In order to avoid any name clashes
during linkage I use objcopy to rename all the sections and symbols
names (applications' start addresses are hard-coded in the kernel).
However, debugging information is [I guess] hard-coded inside those
.debug.* sections and do not get renamed.
Is there a way to rename the debugging information? And, after that,
merge that information with another set of already existent debugging
information?
I have searched GCC's manual to see if I can find an option to prefix
(like a global namespace) all symbols during compilation, but I
haven't found any.
My guess is that there is a debugging format which exposes its
information on the objects symbol table (which can be renamed).
Answer to Question 1)
Step #1 should be possible through the creation of a position
independent executable (I still have to investigate this).
No, it is not possible. A position independent executable is useful when the load address of the executable is known only at load time. In my case, I want to hardwire the load address.
For Step #3 I have no possible solution yet. If GNU ld is used, it
uses some default linker script and the previous relocation is lost.
If GNU gdb accepted archives generated from GNU ar the problem would
be solved (I guess!).
There seems to be no workaround. A linker script is thus mandatory.
Answer to Question 2)
For step #2 I am not sure if debugging information gets renamed or
not.
In fact, debugging information does not get renamed. You can use objdump -s and check that debugging information is hardwired inside those .debug.* sections.
Workaround)
Even without debugging information you can use the object file's symbol table to set breakpoints. However, instead b main your must use b * main because the symbols in the symtable are interpreted as address. This is not much, but it certainly helps.
Related
I have some memorydumps from Linux Redhat GCC compiled programs like:
/apps/suns/runtime/bin/mardb82[0x40853b]
When I open mardb82 and put the breakpoint with break *0x40853b it will give me C filename/lineno which seems quite correct, but not completely.
Can I trust it, and what does it depend on? Is it sufficient if the source file in question is the same or does the files making up the executable have to be the same?
Can I find the locations in sources in some other way?
(Max debug info and sources are present, I haven't tried not having the sources present or passing them in)
When I open mardb82 and put the breakpoint with break *0x40853b it will give me C filename/lineno which seems quite correct, but not completely.
A faster way to get the filename/line:
addr2line -fe /path/to/mardb82 0x40853b
You didn't say where the ...bin/mardb82[0x40853b] line came from. Assuming it is a part of a crash stack, note that the instruction is usually the next after a CALL, so you may be interested in 0x40853b-5 (on *86 architectures) for all but the innermost level in the stack.
what does it depend on? Is it sufficient if the source file in question is the same or does the files making up the executable have to be the same?
The instruction address depends on the particular executable. Any change to source code comprising that executable, to compilation or linking flags, etc. etc. may cause the instructions to shift to a different address.
While running an executable in gdb, I encountered the following error:
Program received signal SIGFPE, Arithmetic exception.
0x08158307 in radtra_ ()
How do I understand what line number and file does 0x08158307 without recompiling or otherwise modifying the source? if it helps, the source language was Fortran.
How do I understand what line number and file does 0x08158307 without recompiling or otherwise modifying the source?
That isn't easy. You could use GDB disassemble command, look for access to global variables and CALL instructions, and make a guess where inside radtra_ you are. This is harder the larger the routine is, the more optimizations compiler has applied to it, and the fewer calls and global variable accesses are performed.
If you can't guess, your only options are:
Rebuild the application adding -g flag, but leaving all other compile options unmodified, then use addr2line to translate the address to line number. (This is how you should build the application from the start.)
If you can't rebuild the entire application, rebuild just the source containing radtra_ (again with same flags, but add -g). You should be able to match the output from objdump -d radtra.o with the output from disassemble. Once you have a match, read output from readelf -wl radtra.o or objdump -g radtra.o to associate code offsets within radtra_ with source lines that code was generated from.
Hire an expert to guess for you. This wouldn't be cheap, as people skilled in this kind of reverse engineering are usually gainfully employed and value their time.
What are the ".map" files generated by gcc/g++ linker option "-Map" used for ?
And how to read them ?
I recommend generating a map file and keeping a copy for any software you put into production.
It can be useful for deciphering crash reports. Depending on the system, you likely can get a stack dump from the crash. The stack dump will include memory addresses and one of the registers will include the Instruction Pointer. That tells you the memory address code was executing at. On some systems, code addresses can be moved around (when loading dynamic libraries, hence, dynamic), but the lower order bytes should remain the same.
The map file is a MAP from memory location -> code location. It gives you the name of the function at a given memory address. Due to optimizations, it may not be extremely accurate, but it gives you a place to start in terms of looking for bugs that cause the crash.
Now, in 30 years of writing commercial software, this is the only thing I've used the map files for. Twice successfully.
What are the ".map" files generated by gcc/g++ linker option "-Map" used for?
There is no such thing as 'gcc linker' -- GCC and linker are independent and separate projects.
Usually the map is used for understanding decisions that ld made while linking the binary. From man ld:
-M
--print-map
Print a link map to the standard output.
A link map provides information about the link, including the following:
· Where object files are mapped into memory.
· How common symbols are allocated.
· All archive members included in the link, with a mention of the symbol which caused the archive member to be brought in.
· The values assigned to symbols.
...
If you don't understand what that means, you likely don't (yet) have the questions that this output answers, and hence have no need to read it.
The compiler gcc is one program that generates object code files, the linker ld is a second program to combine the object code files into an executable. The two can be combined into a single command line.
If you are generating a program to run on an ARM processor you need to use arm-none-eabi-gcc and arm-none-eabi-ld so that the code will be correct for the ARM architecture. Gcc and ld will generate code for your host computer.
I have to find a button's name in a running process memory in Mac OSX and change it.
Supposing there is a "Test" application where it has a "Hello" button, is there any way to attach to "Test" application and change the "Hello!" button to "Bye!"?
I assume this could be done either using GDB or Xcode. If not, how can I do this?
Edit
Assuming you are really looking for dynamic data (as opposed to what your sample seemed to suggest :)) you could always just work with the debugger commands. This will require you to have a sense of the possible memory range to scan (or you'll simply get useless memory violations):
Use gdb commands, loop constructs and libc functions
# assume 0x1234 is a likely base address, say for the heap
(gdb) set $x=0x1234
(gdb) set $y = strdup("lookforthistext")
(gdb) while(0!=memcmp($x++, $y, 15) && $x<0x4321)
>end
(gdb) p $x
(gdb) x $x
This example scans the region 0x1234...0x4321 for the first match and prints/examines the output address.
You can use similar tricks (strncpy...?) to overwrite the memory if you had access to it.
Of course the program may fail dramatically if you do things like changing the length of a substring.. YMMV).
Consider saving your concocted commands as a script (turn on logging, use .gdbinit or even create gdb functions; sadly I know little about the latter)
Original answer:
You "need to"? I doubt it. Your best bet is to work with the windowing/UI API's of your operating system to retrieve the actual window that display the text and make it display another text (usually by sending it appropriate control messages). You'll need plenty of COW powers (think: root) to pull that off.
To answer the direct question:
Usually, messages like this are constants (static data) and as such are either
present in the data segment
read (memory mapped pages) from resources
Both of which are usually (these days at least) in read-only memory segments (think of sharing of memory mapped pages; this gives the kernel opportunity to share mapped regions of shared binary objects between processes - also it serves the obvious security purposes).
On the upside,
strings myprogram | grep 'Hello"
will tell you whether you can use sed, a hex editor or any other suitable editor to manipulate the binary even before it starts. There are two drawbacks I can think of here:
it is not dynamic (you can't have the text change on the fly)
it may break code signing (meaning the executable might get rejected by the OS because it has been modified).
I wonder what is the difference between these two:
gcc -s: Remove all symbol table and relocation information from the executable.
strip: Discard symbols from object files.
Do they have the same meaning?
Which one do you use to:
reduce the size of executable?
speed up its running?
gcc being a compiler/linker, its -s option is something done while linking. It's also not configurable - it has a set of information which it removes, no more no less.
strip is something which can be run on an object file which is already compiled. It also has a variety of command-line options which you can use to configure which information will be removed. For example, -g strips only the debug information which gcc -g adds.
Note that strip is not a bash command, though you may be running it from a bash shell. It is a command totally separate from bash, part of the GNU binary utilities suite.
The accepted answer is very good but just to complement your further questions (and also as reference for anyone that end up here).
What's the equivalent to gcc -s in terms of strip with some of its options?
They both do the same thing, removing the symbols table completely. However, as #JimLewis pointed out strip allows finer control. For example, in a relocatable object, strip --strip-unneeded won't remove its global symbols. However, strip or strip --strip-all would remove the complete symbols table.
Which one do you use to reduce the size of executable and speed up its running
The symbols table is a non-allocable section of the binary. This means that it never gets loaded in RAM memory. It stores information that can be useful for debugging purporses, for instance, to print out a stacktrace when a crash happens. A case where it could make sense to remove the symbols table would be a scenario where you have serious constraints of storage capacity (in that regard, gcc -Os -s or make CXXFLAGS="-Os -s" ... is useful as it will result in a smaller slower binary that is also stripped to reduce size further). I don't think removing the symbols table would result into a speed gain for the reasons commented.
Lastly, I recommend this link about stripping shared objects: http://www.technovelty.org/linux/stripping-shared-libraries.html
"gcc -s" removes the relocation information along with the symbol table which is not done by "strip". Note that, removing relocation information would have some effect on Address space layout randomization. See this link.
They do similar things, but strip allows finer grained control over what gets removed from
the file.