Closed VVvector closed 5 months ago
Solution: attributes of the form DW_FORM_ref4
are expected to contain the offset of the target DIE relative to the current CU, as opposed to the info section. So the elif
block in die_type_rec()
should go instead:
elif t.form == 'DW_FORM_ref4':
ref = t.value
ref_die = dwarfinfo.get_DIE_from_refaddr(ref + die.cu.cu_offset) # Note the addend!
return die_type_rec(ref_die, die)
Both GNU readelf
and pyelftools' readelf.py display that attribute's value with CU offset already added. It's more useful that way, displays a section relative offset you can search by.
Also, there is get_DIE_from_attribute()
in the DIE object - specifically to follow inter-DIE references.
There are other problems in the script. The assumptions about struct member DIE contents don't hold for bitfield types.
For easier eyeballing of the DWARF, may I recommend DWARF Explorer ( https://github.com/sevaa/dwex ). Full disclosure: I wrote it.
Solution: attributes of the form
DW_FORM_ref4
are expected to contain the offset of the target DIE relative to the current CU, as opposed to the info section. So theelif
block indie_type_rec()
should go instead:elif t.form == 'DW_FORM_ref4': ref = t.value ref_die = dwarfinfo.get_DIE_from_refaddr(ref + die.cu.cu_offset) # Note the addend! return die_type_rec(ref_die, die)
Both GNU
readelf
and pyelftools' readelf.py display that attribute's value with CU offset already added. It's more useful that way, displays a section relative offset you can search by.Also, there is
get_DIE_from_attribute()
in the DIE object - specifically to follow inter-DIE references.There are other problems in the script. The assumptions about struct member DIE contents don't hold for bitfield types.
For easier eyeballing of the DWARF, may I recommend DWARF Explorer ( https://github.com/sevaa/dwex ). Full disclosure: I wrote it.
Thank you so much. I have verified the script with your comments. In addition, I have processed the bitfiled part accordingly.
Using pyelftools 0.31
I want to use the pyelftools to parse the structure information in Linux kernel module ELF binary, but the following error occurs:
Reproduce
More I tried to analyze and found that the value parsing of DW_AT_type in some structures was inconsistent with the data parsed by readelf tool. e.g. - parsed by readelf
- parsed by pyelftools:
For the same DIE, the DW_AT_type obtained by the above two methods is different, one is 0x68e3, and the other is 24917 (0x6155).