How can I examine contents of a data section of an ELF file on Linux?
Solution 1
objdump -s -j .rodata exefile
gives a side-by-side hex/printable ASCII dump of the contents of the rodata
section like:
Contents of section .rodata:
0000 67452301 efcdab89 67452301 efcdab89 gE#.....gE#.....
0010 64636261 68676665 64636261 68676665 dcbahgfedcbahgfe
It doesn't look like there's anything in there to control formatting, but it's a start. You could always undump the hex and feed it to od, I suppose :)
Solution 2
readelf -x .rodata hello_world.o
gives:
Hex dump of section '.rodata':
0x00000000 48656c6c 6f20776f 726c6421 0a Hello world!.
You should prefer readelf
when possible since objdump
simply does not show some sections like .symtab
: Why does objdump not show .bss, .shstratab, .symtab and .strtab sections?
You can also extract the raw bytes with the techniques mentioned at: How do you extract only the contents of an ELF section and as mentioned by ysdx.
Solution 3
You can get the RAW (not hexdump-ed) ELF section with:
# To a file:
objcopy file /dev/null --dump-section .text=text.data
# To stdout:
objcopy file /dev/null --dump-section .text=/dev/stdout | cat
Here I'm using | cat
in order to force stdout to be a pipe. /dev/stdout
might work unexpectedly if stdout is a file. .text=-
does not send to stdout but to the -
file.
However objcopy and objdump have some deficiencies (because they are based on BFD which abstracts different executable formats).
Update: I wrote a tool to do this which does not rely on BFD.
Norman Ramsey
Every time I see a question about "strong" or "weak" typing, I kill a kitten.
Updated on January 22, 2020Comments
-
Norman Ramsey over 4 years
I've been using
objdump
to look at assembly code in Linux ELF binaries.Sometimes there is an indirect jump through a jump table that is stored in the
rodata
(read-only data) section.How to get
objdump
or any other tool to show me the contents of this data section?I could execute the program and examine the relevant addresses in the debugger, but I don't want to do that because it has to be done interactively.
The ideal answer will identify a tool that will not only show me the contents but will let me control the display format, much as
od
does. -
Bogatyr over 11 yearsHow can you get the data dumped in binary format from an ELF section? Something like objdump -s -j -binary <section> <file> would be great.
-
ysdx almost 9 years@Bogatyr: cf. my answer.
-
Ciro Santilli OurBigBook.com almost 9 years
--dump-section
is a bit recent. It was added at: sourceware-org.1504.n7.nabble.com/… Why is it better than--only-section
? -
ysdx almost 9 years@CiroSantilli六四事件法轮功纳米比亚威视, well the
objcopy -j
creates a whole ELF file (which a ELF header, a section heaer table with a .shstrtab section, a program header table) whereasobjcopy --dump-section
dumps the content of a section (and nothing else) to a file. -
haxpor almost 3 yearsVery good solution. Additionally, especially for
.modinfo
section, to print each parameter and its value line by line, we can use... | xargs --null -n1 -I{} echo {};
as each pair ends with a0x00
byte value as inspected from original output. PS: It's my habit to use-n1
but it's redundant in such mentioned command.