0

For example, there is a symbol named country, I can get its information (type, address, and length) by nm -D -S

$ nm -D libs_ma.so -S
                 w _ITM_deregisterTMCloneTable
                 w _ITM_registerTMCloneTable
                 w __cxa_finalize
                 w __gmon_start__
0000000000004028 0000000000000008 D country

But how can I dump the address (4028) with length (8) by some Linux command (just like dlsym() and printf() worked in c program)?

Employed Russian
  • 199,314
  • 34
  • 295
  • 362
progquester
  • 1,228
  • 14
  • 23

1 Answers1

0

how can I dump the address (4028) with length (8) by some Linux command

Your best bet is probably to use a debugger, such as radare2 or GDB.

This question shows how to do that in radare2.

Here is how you could do this using GDB:

// foo.c
long country = 0xABCDEF0123456789;

gcc -shared -fPIC -o foo.so foo.c
nm -D foo.so | grep country
0000000000004020 D country

gdb -q --batch -ex 'x/gx 0x4020' foo.so
0x4020 <country>:       0xabcdef0123456789

It is also rather easy to write a program in a language of your choice to do this. Your program would have to:

  1. iterate over LOAD segments until it finds one with .p_vaddr <= $address < .p_vaddr + .p_memsz
  2. mmap or read that segment, seek to $address - .p_vaddr offset, and dump $length bytes from there.
Employed Russian
  • 199,314
  • 34
  • 295
  • 362