eliben / pyelftools

Parsing ELF and DWARF in Python
Other
2.02k stars 511 forks source link

some problems about Section.data() #450

Open Absoler opened 1 year ago

Absoler commented 1 year ago

Hi, I'm trying to extract assembly info from an object file, so I used ELFFile.get_section_by_name('.text') and Section.data(), like:

import sys sys.path.insert(0, '.') from elftools.elf.elffile import ELFFile

with open("/root/linux-master/drivers/tty/serial/earlycon.o", "rb") as f: elf = ELFFile(f, sys.stdout) text = elf.get_section_by_name('.text') textInfo = text.stream.read() print(len(textInfo)) addr = text['sh_addr'] code = text.data() print(code)

However, the output content is:

3219 b""

And I don't understand why text.data() can't return the assembly info stream. related file is uploaded.

earlycon.zip

amilendra commented 1 year ago

Looking at the section table of earlycon.o, it does not have any data. Notice the size 0.

llvm-readelf -S earlycon.o 
There are 37 section headers, starting at offset 0x422d0:

Section Headers:
  [Nr] Name              Type            Address          Off    Size   ES Flg Lk Inf Al
  [ 0]                   NULL            0000000000000000 000000 000000 00      0   0  0
  [ 1] .text             PROGBITS        0000000000000000 000040 000000 00  AX  0   0  1

Also

And I don't understand why text.data() can't return the assembly info stream. related file is uploaded.

I don't know what you mean by assembly info stream, but if you expect the dissassemly of the .text section, that is not possible because pyelftools is not a dissassembler. For that you should be using a separate tool like objdump.

For example

objdump -d hello.o

hello.o:     file format elf64-x86-64

Disassembly of section .text:

0000000000000000 <main>:
   0:   f3 0f 1e fa             endbr64 
   4:   55                      push   %rbp
   5:   48 89 e5                mov    %rsp,%rbp
   8:   c7 45 fc 05 00 00 00    movl   $0x5,-0x4(%rbp)
   f:   8b 45 fc                mov    -0x4(%rbp),%eax
  12:   5d                      pop    %rbp
  13:   c3                      ret    

Hope that helps.

sevaa commented 6 months ago

@Absoler is this still an issue?