4 ms·

If anyone wants to take a look at the struct offsets inside their own code, the article mentions pahole as being a useful tool but I found that it chokes on rec

by pja 12y ago

If anyone wants to take a look at the struct offsets inside their own code, the article mentions pahole as being a useful tool but I found that it chokes on recent C++ - the dwarf libraries it relies on can't cope with lambdas and various other things IIRC. However, helpful people have written an extension to gdb which does something roughly equivalent & lets gdb do all the heavy lifting of parsing the struct data from the binary debugging information. pahole.py ships with Fedora, but since Debian doesn’t include it for some reason I’ve kept my own versions around based on something I grabbed from the gdb mailing lists some time ago: https://github.com/PhilArmstrong/pahole-gdb https://github.com/PhilArmstrong/pahole-gdb

throwabob412 12y ago
pahole is fantastic. If it worked on modern clang-generated binaries, it would still be the best. This entire article could be replaced with "use pahole." Anyway, the problem with pahole is that it is heavily dependent on libdwarves, a custom wrapper around libdwarf by the pahole author. libdwarves has bitrotted since 2010-2011 and newer dwarf extensions produce aborts. Hurray. I started a similar tool in C just using libdwarf directly. It's not complete and/or perfect, but it works on some binaries that pahole does not. See https://github.com/cemeyer/structhole https://github.com/cemeyer/structhole . (And it's < 500 LoC and BSD-licensed. Please use as you will and contribute patches if you are interested in improving it.) Cheers.
- comex 12y ago
  The following is not very useful since I never bothered to polish it up or write any documentation, but in case anyone is curious, it's a similar tool I wrote that focuses on performance, outputs JSON, and uses no external libraries. I needed to dump struct info from a binary I was trying to exploit, which had debug info available in DWARF format, but was huge. (gigabytes) pahole not only took like half an hour to get through it, it leaked memory such that it took up most of my 16 GB of RAM by the end, which was immensely frustrating; my tool does it in a few seconds. (There's also a Windows PDB version which is older and probably broken.) https://github.com/comex/fastdbg/blob/master/fastdwarf.c https://github.com/comex/fastdbg/blob/master/fastdwarf.c

by pja 12y ago

throwabob412 12y ago

pahole is fantastic. If it worked on modern clang-generated binaries, it would still be the best. This entire article could be replaced with "use pahole." Anyway, the problem with pahole is that it is heavily dependent on libdwarves, a custom wrapper around libdwarf by the pahole author. libdwarves has bitrotted since 2010-2011 and newer dwarf extensions produce aborts. Hurray. I started a similar tool in C just using libdwarf directly. It's not complete and/or perfect, but it works on some binaries that pahole does not. See https://github.com/cemeyer/structhole https://github.com/cemeyer/structhole . (And it's < 500 LoC and BSD-licensed. Please use as you will and contribute patches if you are interested in improving it.) Cheers.

comex 12y ago
The following is not very useful since I never bothered to polish it up or write any documentation, but in case anyone is curious, it's a similar tool I wrote that focuses on performance, outputs JSON, and uses no external libraries. I needed to dump struct info from a binary I was trying to exploit, which had debug info available in DWARF format, but was huge. (gigabytes) pahole not only took like half an hour to get through it, it leaked memory such that it took up most of my 16 GB of RAM by the end, which was immensely frustrating; my tool does it in a few seconds. (There's also a Windows PDB version which is older and probably broken.) https://github.com/comex/fastdbg/blob/master/fastdwarf.c https://github.com/comex/fastdbg/blob/master/fastdwarf.c