如何在Linux上检查ELF文件的数据部分的内容? [英] How can I examine contents of a data section of an ELF file on Linux?

问题描述

我一直在使用objdump来查看Linux ELF二进制文件中的汇编代码.

I've been using objdump to look at assembly code in Linux ELF binaries.

有时会间接跳转到存储在rodata(只读数据)部分中的跳转表中.

Sometimes there is an indirect jump through a jump table that is stored in the rodata (read-only data) section.

如何获取objdump或任何其他工具来向我显示此数据部分的内容?

How to get objdump or any other tool to show me the contents of this data section?

我可以执行程序并在调试器中检查相关地址，但是我不想这样做，因为它必须以交互方式完成.

I could execute the program and examine the relevant addresses in the debugger, but I don't want to do that because it has to be done interactively.

理想的答案将是确定一个不仅可以显示内容的工具，还可以让我控制显示格式的工具，就像od一样.

The ideal answer will identify a tool that will not only show me the contents but will let me control the display format, much as od does.

推荐答案

objdump -s -j .rodata exefile

给出rodata部分内容的并排十六进制/可打印ASCII转储，例如:

gives a side-by-side hex/printable ASCII dump of the contents of the rodata section like:

Contents of section .rodata:
 0000 67452301 efcdab89 67452301 efcdab89  gE#.....gE#.....
 0010 64636261 68676665 64636261 68676665  dcbahgfedcbahgfe

似乎没有任何东西可以控制格式设置，但这只是一个开始.我想，您总是可以取出十六进制并将其输入到od:)

It doesn't look like there's anything in there to control formatting, but it's a start. You could always undump the hex and feed it to od, I suppose :)

这篇关于如何在Linux上检查ELF文件的数据部分的内容?的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！