set breakpoint in an stripped ELF executable

问题:

I have an ELF 32-bit dynamically linked, stripped file which I wish to debug. While trying to set a breakpoint at an address a message saying that the symbol table is not loaded.

My questions are:

1. When you say that an ELF file is stripped what exactly is happening?
2. How do you strip an ELF file?
3. Is it possible to reconstruct the symbol table somehow?
4. Is it not possible to set breakpoints in gdb on a stripped executable?

回答1:

Stripping ELFs is is done with the gnu binutils tool strip, from the strip man page:

GNU strip discards all symbols from object files objfile. The list of object files may include archives. At least one object file must be given.

When you say that an ELF file is stripped what exactly is happening?

Stripping removes not-essential information from the binary. That may be just the debug-data or not exported symbols.

How do you strip an ELF file?

You can strip a binary by using strip like strip -s yourLittleBinary - which will replace the file with a stripped version. The option -s tells strip to remove all symbols. Strip can operate in a number of ways. Again, from it's man page:

   -R sectionname
   --remove-section=sectionname
       Remove any section named sectionname from the output file. 

This option may be given more than once. Note that using this option inappropriately may make the output file unusable.

   -s
   --strip-all
       Remove all symbols.

   -g
   -S
   -d
   --strip-debug
       Remove debugging symbols only.

   --strip-unneeded
       Remove all symbols that are not needed for relocation processing.

Is it possible to reconstruct the symbol table somehow?

As far as I know, it is not possible. It is however possible to create a kind of map file from the executable before stripping, in order to retain the information needed for debugging.

Is it not possible to set breakpoints in gdb on a stripped executable?

It is possible. It's just an executable - stripped of it's symbol names. However, as there are no symbols the only thing that (apart from having a map file that provides you with an address <-> name mapping) remains is setting break points at specific addresses. You can however set break points at any function of shared libraries that the executable in question uses.

On map files

You can create a map file from an executable using the nm utility:

nm -Cn myLittleExecutable > myLittleExecutable.map

This will dump all symbols, C++-demangled (option -C) and sorted numerically (option -n).

Links

This might give you some ideas: http://www.linuxsa.org.au/meetings/reveng-0.2.pdf
GNU binutils docs: http://sourceware.org/binutils/docs-2.21/binutils/index.html
GDB documentation: http://www.gnu.org/software/gdb/documentation/