How to extract only the raw contents of an ELF section?

Question

I've tried the following, but the resulting file is still an ELF and not purely the section content.

$ objcopy --only-section=<name> <infile> <outfile>

I just want the contents of the section. Is there any utility that can do this? Any ideas?

score 71 · Answer 1 · edited Jun 08 '11 at 12:32

71

Use the -O binary output format:

objcopy -O binary --only-section=.text foobar.elf foobar.text

Just verified with avr-objcopy and an AVR ELF image's .text section.

Note that if, as Tim points out below, your section doesn't have the ALLOC flag, you may have to add --set-section-flags .text=alloc to be able to extract it.

edited Jun 08 '11 at 12:32

Community

1
1

answered Oct 13 '10 at 15:04

ndim

35,870
12
47
57

1

When I add this, the resulting is empty. It contains neither the ELF section header nor the section content. The command I used in the question does not produce an empty file. – mepcotterell Oct 13 '10 at 15:15
4

The following works for me: objcopy -O binary -j .text /usr/bin/lpr mylprtext – Eric Seppanen Oct 13 '10 at 16:10
11

This neat trick doesn't work for all sections. `objcopy` will not copy out sections that are flagged neither loaded ("load") nor allocated ("alloc"). A comment in the source claims that "The contents of such a section are not meaningful in the binary format." – Tim Schaeffer Apr 06 '11 at 16:39
2

Strangely enough, but objcopy prints: Unable to recognise the format of the input file `elf.img', when objdump prints sections normally. – Vanuan Dec 19 '11 at 22:08
3

This alongside with the --set-section-flags allowed me to dump .ARM.attributes into a file. Wouldn't touch the awk script in the other answer with a stick ;) +1. – Antti Haapala -- Слава Україні Sep 22 '14 at 15:42

score 38 · Answer 2 · edited Jun 20 '20 at 09:12

objcopy --dump-section

Introduced in Binutils 2.25, and achieves a similar effect to -O binary --only-section.

Usage:

objcopy --dump-section .text=output.bin input.o

https://sourceware.org/binutils/docs-2.25/binutils/objcopy.html documents it as:

--dump-section sectionname=filename

Place the contents of section named sectionname into the file filename, overwriting any contents that may have been there previously. This option is the inverse of --add-section. This option is similar to the --only-section option except that it does not create a formatted file, it just dumps the contents as raw binary data, without applying any relocations. The option can be specified more than once.

Minimal runnable example

main.S

.data
    .byte 0x12, 0x34, 0x56, 0x78
.text
    .byte 0x9A, 0xBC, 0xDE, 0xF0

Assemble:

as -o main.o main.S

Extract data:

objcopy --dump-section .data=data.bin main.o
hd data.bin

Output:

00000000  12 34 56 78                                       |.4Vx|
00000004

Extract text:

objcopy --dump-section .text=text.bin main.o
hd text.bin

Output:

00000000  9a bc de f0                                       |....|
00000004

Tested in Ubuntu 18.04 amd64, Binutils 2.30.

This should be the best answer. – DexterHaxxor Feb 28 '19 at 14:57 — DexterHaxxor, Feb 28 '19 at 14:57

score 17 · Accepted Answer · answered Oct 13 '10 at 15:56

17

Rather inelegant hack around objdump and dd:

IN_F=/bin/echo
OUT_F=./tmp1.bin
SECTION=.text

objdump -h $IN_F |
  grep $SECTION |
  awk '{print "dd if='$IN_F' of='$OUT_F' bs=1 count=$[0x" $3 "] skip=$[0x" $6 "]"}' |
  bash

The objdump -h produces predictable output which contains section offset in the elf file. I made the awk to generate a dd command for the shell, since dd doesn't support hexadecimal numbers. And fed the command to shell.

In past I did all that manually, without making any scripts, since it is rarely needed.

answered Oct 13 '10 at 15:56

Dummy00001

16,630
5
41
63

That would sound funny coming from me, but why not the straight-forward *proper* solution from @ndim??? – Dummy00001 Oct 13 '10 at 22:14
If the file produced by the other solution is 0 bytes, just add `--set-section-flags .sectionname=alloc` on the command line. – Antti Haapala -- Слава Україні Sep 22 '14 at 15:45
good idea but it does not work for me.. see my answer which is similar – Zibri Jun 05 '19 at 17:50

Zibri · Answer 4 · 2019-06-05T18:01:12.860

0

Dump all sections in separate files.

readelf -a filename|grep "NULL\|LOAD"| (x=0;while read a;do echo "$x $a"|awk '{print "dd if=143 of=filename.section."$1" bs=1 skip=$((" $3")) count=$(("$6"))"}';let x=x+1;done)|bash

edited Jun 05 '19 at 18:01

answered Jun 05 '19 at 17:51

Zibri

9,096
3
52
44

score 0 · Answer 5 · answered Dec 14 '22 at 11:56

Here is another shot at the problem that uses only readelf, bash and dd.

#!/bin/bash

sections="\.symtab|\.strtab"

if [ "$#" -ne 1 ]; then
  echo "Usage $0 [INPUT ELF FILE]"
  exit 1
fi

readelf -S "$1" | while IFS= read -r line; do
    pattern="\[[[:digit:]]+\].*(${sections}) +[[:alpha:]]+ +[[:xdigit:]]+ +([[:xdigit:]]+) +([[:xdigit:]]+)"
    if [[ ${line} =~ $pattern ]]; then
      sec=${BASH_REMATCH[1]}
      off=${BASH_REMATCH[2]}
      len=${BASH_REMATCH[3]}
       dd if="$1" of="$1${sec}.raw" bs=1 skip=$(("0x$off")) count=$(("0x$len"))
    fi
done

As you can see, I am using this to extract the symtab and strtab sections because they are impossible to extract otherwise (e.g., with objcopy and cannot be set allocatable).

How to extract only the raw contents of an ELF section?

5 Answers5

Linked