Jserv's blog

1
2
3
4
5
6
7
8

void test()
{
}

int main()
{
	test();
}

1
2
3
4
5
6
7
8
9
10
11
12
13

#include <stdio.h>
void test()
{
	unsigned int *stack;
	asm ("movl %%ebp, %0\n"
	     : "=g"(stack));
	printf("Return address = 0x%x\n", *(stack+1));
}

int main()
{
	test();
}

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65

#include <stdio.h>
#include <bfd.h>

int main(int argc, char *argv[])
{
	bfd *abfd;
	long storage_needed;  
	asymbol **symbol_table;
	long number_of_symbols;
	long i;
	char **matching;
	sec_ptr section;
	char *symbol_name; 
	long symbol_offset, section_vma, symbol_address;

	if (argc < 2)
		return 0;
	printf("Open %s\n", argv[1]);
	bfd_init();
	abfd = bfd_openr(argv[1],NULL);
	if (abfd == (bfd *) 0) {
		bfd_perror("bfd_openr");
		return -1; 
	}
	if (!bfd_check_format_matches(abfd, bfd_object, &matching)) {
		return -1;
	}      
	if (!(bfd_get_file_flags (abfd) & HAS_SYMS)) {
		printf("ERROR flag!\n");
		return -1;
	}
	/* 取得符號表大小 */
	storage_needed = bfd_get_symtab_upper_bound(abfd);
	if (storage_needed < 0)
		return -1;
	symbol_table = (asymbol **) xmalloc(storage_needed);
	/* 將符號表讀進所配置的記憶體裡(symbol_table), 並傳回符號表個數 */
	number_of_symbols = bfd_canonicalize_symtab(abfd, symbol_table);
	if (number_of_symbols < 0)
		return -1;
	for (i = 0; i < number_of_symbols; i++) {
		/* 檢查此符號是否為函式 */
		if (symbol_table[i]->flags & (BSF_FUNCTION|BSF_GLOBAL))	{
			/* 反查此函式所處的區段(section) 及
			                   區段位址(section_vma) */
			section = symbol_table[i]->section;
			section_vma = bfd_get_section_vma(abfd, section);
			/* 取得此函式的名稱(symbol_name)、
			               偏移位址(symbol_offset) */
			symbol_name = symbol_table[i]->name;
			symbol_offset = symbol_table[i]->value;
			/* 將此函式的偏移位址加上區段位址，則為此函式在執行時
			   的記憶體位址(symbol_address */
			symbol_address = section_vma + symbol_offset;
			/* 檢查此函式是否處在程式本文區段 */
			if (section->flags & SEC_CODE)
				printf("<%s> 0x%x 0x%x 0x%x\n",
				         symbol_name,  
				               section_vma,  
				                    symbol_offset,
				                         symbol_address);
		}
	}
	bfd_close(abfd);
}

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109

/* bfd_dumpfun.c (GPL)
 *
 * Usage: ./bfd_dumpfun [binary]
 * Note: Dump functions infomation of ELF-binary with BFD Library.
 *     
 * by TimHsu(timhsu@info.sayya.org) 2004/03/31
 * Modified by Jim Huang <jserv.tw@gmail.com>, 2008/07/22
 *   - Bump bfd APIs and build fixes.
 */

#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <bfd.h>

typedef struct function_table FUN_TABLE;

/* 宣告一個包含函式名稱和位址的結構 */
struct function_table {
	char name[80];
	unsigned long addr;
};

static FUN_TABLE *fun_table;
static int table_count = 0;   /* 函式個數 */

static int compare_function(const void *a, const void *b)
{
	FUN_TABLE *aa = (FUN_TABLE *) a, *bb = (FUN_TABLE *) b;
	if (aa->addr > bb->addr)
		return 1;
	else if (aa->addr < bb->addr)
		return -1;
	return 0;  
}

/* 增加一個函式資料至對照表 */
static void add_function_table(char *name, unsigned long address)
{
	strncpy(fun_table[table_count].name, name, 80);
	fun_table[table_count].addr = address;
	table_count++;  
}

static void dump_function_table(void)
{
	int i;
	for (i = 0; i < table_count; i++) {
		printf("%-30s 0x%x\n",
		       fun_table[i].name, fun_table[i].addr);
	}
}

int main(int argc, char *argv[])
{
	bfd *abfd;
	asection *text;
	long storage_needed;
	asymbol **symbol_table;
	long number_of_symbols;
	long i;
	char **matching;
	sec_ptr section;
	char *symbol_name;
	long symbol_offset, section_vma, symbol_address;

	if (argc < 2) 
		return 0;
	printf("Open %s\n", argv[1]);
	bfd_init();
	abfd = bfd_openr(argv[1],NULL);
	if (abfd == (bfd *) 0) {
		bfd_perror("bfd_openr");
		return -1;
	}
	if (!bfd_check_format_matches(abfd, bfd_object, &matching)) {
		return -1;
	}      
	if (!(bfd_get_file_flags (abfd) & HAS_SYMS)) {
		printf("ERROR flag!\n");
		return -1;
	}
	if ((storage_needed = bfd_get_symtab_upper_bound(abfd)) < 0)
		return -1;
	symbol_table = (asymbol **) xmalloc(storage_needed);
	number_of_symbols = bfd_canonicalize_symtab(abfd, symbol_table);
	if (number_of_symbols < 0)
		return -1;
	fun_table = (FUN_TABLE **)malloc(sizeof(FUN_TABLE)*number_of_symbols);
	bzero(fun_table, sizeof(FUN_TABLE)*number_of_symbols);

	for (i = 0; i < number_of_symbols; i++) {
		if (symbol_table[i]->flags & (BSF_FUNCTION|BSF_GLOBAL)) {
			section = symbol_table[i]->section;
			section_vma = bfd_get_section_vma(abfd, section);
			symbol_name = symbol_table[i]->name;
			symbol_offset = symbol_table[i]->value;
			symbol_address = section_vma + symbol_offset;
			if (section->flags & SEC_CODE) {
				add_function_table(symbol_name,
				                   symbol_address);
			}
		}
	}
	bfd_close(abfd);
	/* 將函式對照表作排序 */
	qsort(fun_table, table_count, sizeof(FUN_TABLE), compare_function);
	dump_function_table();
}

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15

#include <stdio.h>

#define	FUNCTION_NAME_MAXLEN		80

#define who_call_me() \
	do { \
        	unsigned int *stack; \
		asm ("movl %%ebp, %0\n"  \
		     : "=g"(stack));  \
		fprintf(stderr, \
			"<whocallme>: function <%s> call me <%s>!\n", \
			find_function_by_addr(*(stack+1)), who_am_i()); \
	} while(0)

extern int init_function_table(char *);

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135

/* whocallme.c (GPL)
 *
 * A runtime backtrace of function. 
 * 
 * by Timhsu(timhsu@chroot.org) 2004/03/31
 * Modified by Jim Huang <jserv.tw@gmail.com>, 2008/07/22
 *   - Bump bfd APIs.
 *   - Eliminate compiler errors.
 */

#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <bfd.h>
#include "whocallme.h"

/* forward declarations */
char *find_function_by_addr(unsigned long addr);

typedef struct function_table FUN_TABLE;
/* 宣告一個包含函式名稱和位址的結構 */
struct function_table {
	char name[FUNCTION_NAME_MAXLEN];
  	unsigned long addr;
};

static FUN_TABLE *fun_table;
static int table_count = 0;	/* 函式個數 */

static int compare_function(const void *a, const void *b)
{
        FUN_TABLE *aa = (FUN_TABLE *) a;
        FUN_TABLE *bb = (FUN_TABLE *) b;
	if (aa->addr > bb->addr)
		return 1;
	else if (aa->addr < bb->addr)
		return -1;
	return 0;
}

/* 增加一個函式資料至對照表 */
static void add_function_table(char *name, unsigned long address)
{
	strncpy(fun_table[table_count].name, name, FUNCTION_NAME_MAXLEN);
	fun_table[table_count].addr = address;
	table_count++;
}

/* 取得目前正在執行的函式名稱 */
char * who_am_i(void)
{
        unsigned long *stack;   \
	asm ("movl %%ebp, %0\n"  \
		: "=g"(stack));         
	return find_function_by_addr(*(stack + 1));
}

/* 依照位址取得函式名稱 */
char *find_function_by_addr(unsigned long addr)
{
	int i;
	for (i = 0; i < table_count; i++) {
		if (addr > fun_table[i].addr) {
			if (addr < fun_table[i + 1].addr)
				return fun_table[i].name;
		}
	}
	return NULL;
}

/* 初始化函式對照表 */
int init_function_table(char *file)
{
	bfd *abfd;
	long storage_needed;
	asymbol **symbol_table;
	long number_of_symbols;
	long i;
	char **matching;
	sec_ptr section;
	char *symbol_name;
	long symbol_offset, section_vma, symbol_address;

	bfd_init();
	abfd = bfd_openr(file, NULL);
	if (abfd == (bfd *) 0) {
		bfd_perror("bfd_openr");
		return -1;
	}
	if (!bfd_check_format_matches(abfd, bfd_object, &matching)) {
		return -1;
	}	
	if (!(bfd_get_file_flags (abfd) & HAS_SYMS)) {
		printf("ERROR flag!\n");
		return -1;
	}
	/* 取得符號表大小 */
	storage_needed = bfd_get_symtab_upper_bound(abfd);
	if (storage_needed < 0)
		return -1;
	symbol_table = (asymbol **) malloc(storage_needed);
	/* 將符號表讀進所配置的記憶體裡(symbol_table), 並傳回符號表個數 */
	number_of_symbols = bfd_canonicalize_symtab(abfd, symbol_table);
	if (number_of_symbols < 0)
		return -1;
	/* 配置空間給函式對照表 */
	fun_table = (FUN_TABLE *) malloc(sizeof(FUN_TABLE) * number_of_symbols);
	bzero(fun_table, sizeof(FUN_TABLE)*number_of_symbols);

	for (i = 0; i < number_of_symbols; i++) {
		/* 檢查此符號是否為函式 */
		if (symbol_table[i]->flags & (BSF_FUNCTION|BSF_GLOBAL)) {
			/* 反查此函式所處的區段(section) 及區段位址(section_vma)*/ */
			section = symbol_table[i]->section;
			section_vma = bfd_get_section_vma(abfd, section);
			/* 取得此函式的名稱(symbol_name), 偏移位址(symbol_offset) */
			symbol_name = (char *) symbol_table[i]->name;
			symbol_offset = symbol_table[i]->value;
			/* 將此函式的偏移位址加上區段位址，則為此函式
			 * 在執行時的記憶體位址 (symbol_address) */
			symbol_address = section_vma + symbol_offset;
			/* 檢查此函式是否處在程式本文區段 */
			if (section->flags & SEC_CODE) {
				/* 將此函式名稱和位址加入至對照表 */
			add_function_table(symbol_name, 
						   symbol_address);
			}
		}
	}
	free(symbol_table);
	bfd_close(abfd);
	/* 將函式對照表作排序 */
	qsort(fun_table, table_count, sizeof(FUN_TABLE), compare_function);
	return 0;
}

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27

#include "whocallme.h"

void test()
{
	who_call_me(); 
}
void test_a()
{
	test_b();
	test_c();
}
void test_b()
{
	test();
}
void test_c()
{
	who_call_me(); 
}
int main(int argc, char *argv[])
{
	init_function_table(argv[0]);
	test();
	test_a();      
	test_b();
	test_c();
}