Related articles |
---|
How can a disassembler tell code from data? dwex@mtgzfs3.att.com (1991-05-09) |
Re: How can a disassembler tell code from data? rfg@ncd.com (1991-05-11) |
Newsgroups: | comp.compilers |
From: | rfg@ncd.com (Ron Guilmette) |
Keywords: | disassemble, design |
Organization: | Network Computing Devices, Inc., Mt. View, CA |
References: | <91-05-072@iecc.cambridge.ma.us> |
Date: | 11 May 91 18:30:57 GMT |
In article <91-05-072@iecc.cambridge.ma.us> dwex@mtgzfs3.att.com (David E Wexelblat) writes:
>... My problem is trying to disassemble code compiled with GCC,
>which puts constant character strings into the text segment...
>... I would like a general-case answer, but the
>following constraints can be applied, if necessary:
>
..
> 3) COFF format object files
The general case answer is to stop using COFF and use ELF instead.
In ELF, constant data can go into the .rodata or .rodata1 *sections*. The
linker will normally combine all input .rodata sections (for all of the .o
files given to it as inputs) into one hunk of output .rodata stuff and it
will normally attach that to the output .text *segment*, however you can
use the MAPEFILE option to override this behavior and to get all of the
.rodata stuff placed into its own unique (LOADable) output segment. You
could then just ignore that output segment when doing your disassembly.
Actually, you do not even need to use the MAPFILE option (necessarily).
As long as you do not strip the executable, it will include both a segment
header table *and* a section header table. In the section header table
there will be one entry for the collected sum of all of the input .rodata
sections. This header will indicate where (within the executable) the
start and end of all of the .rodata stuff is. You could then just ignore
anything in that range.
You may be able to duplicate one or both of these techniques with COFF,
but I'm not sure.
--
// Ron ("Loose Cannon") Guilmette
// Internet: rfg@ncd.com uucp: ...uunet!lupine!rfg
--
Return to the
comp.compilers page.
Search the
comp.compilers archives again.