readelf --string-dump analog for objdump

readelf --string-dump analog for objdump

[Maxim Dementyev]

[-- Attachment #1: Type: text/plain, Size: 678 bytes --]

Hi,

The readelf utility has a very useful option - "--string-dump=<number or
name>" which displays the contents of the indicated section as is (as
printable strings).
As far as I can understand, to do the same with the objdump you need to do
"objdump --section=<number or name> --full-contents ...".
But the output is in the "hexdump" format, the contents is splitted by 0x10
size blocks (so, not possible to grep on this contents).

Is there any plans to implement a printable strings format for this case
for the objdump utility?
Or is there a solution without parsing the hexdump format and restoring
these printable strings?

Thank you in advance!

Best regards,
Max

-- 

Re: readelf --string-dump analog for objdump

[Jan Beulich]

On 22.01.2024 11:43, Maxim Dementyev wrote:
> The readelf utility has a very useful option - "--string-dump=<number or
> name>" which displays the contents of the indicated section as is (as
> printable strings).
> As far as I can understand, to do the same with the objdump you need to do
> "objdump --section=<number or name> --full-contents ...".
> But the output is in the "hexdump" format, the contents is splitted by 0x10
> size blocks (so, not possible to grep on this contents).
> 
> Is there any plans to implement a printable strings format for this case
> for the objdump utility?
> Or is there a solution without parsing the hexdump format and restoring
> these printable strings?

From what you write I can only guess that you'd like to use the functionality
on non-ELF objects which binutils as whole (and maybe objdump in particular)
supports. If so, is there a reason you can't extract the section(s) in
question using "objcopy --only-section" (e.g. as a raw binary file), and then
use "strings" on the result?

Jan

Re: readelf --string-dump analog for objdump

[Maxim Dementyev]

[-- Attachment #1: Type: text/plain, Size: 2135 bytes --]

Dear Jan,

Thanks for pointing me out the objdump utility!
Unfortunately, --only-section isn't a good choice: it produces all other
information in the output file, not only the section in question.
But I've found the need option of objdump utility: --dump-section
Unfortunately, apart from this, again, the objdump utility creates a
formatted file as an output, and I can add --only-section to reduce the
size of it and redirect it to /dev/null.

So, this is usable with one intermediate file for a section.
But it is much more complicated than just:
"readelf -p section file | grep something".

And a possible solution (how to improve the objdump utility in a generic
way) could be a special value for the --dump-section option to produce the
output only for this section instead of redirecting it to a separate file:
"objcopy --dump-section section=stdout | grep something"

Thanks again!

With respect,
Max



On Mon, Jan 22, 2024 at 11:58 AM Jan Beulich <jbeulich@suse.com> wrote:

> On 22.01.2024 11:43, Maxim Dementyev wrote:
> > The readelf utility has a very useful option - "--string-dump=<number or
> > name>" which displays the contents of the indicated section as is (as
> > printable strings).
> > As far as I can understand, to do the same with the objdump you need to
> do
> > "objdump --section=<number or name> --full-contents ...".
> > But the output is in the "hexdump" format, the contents is splitted by
> 0x10
> > size blocks (so, not possible to grep on this contents).
> >
> > Is there any plans to implement a printable strings format for this case
> > for the objdump utility?
> > Or is there a solution without parsing the hexdump format and restoring
> > these printable strings?
>
> From what you write I can only guess that you'd like to use the
> functionality
> on non-ELF objects which binutils as whole (and maybe objdump in
> particular)
> supports. If so, is there a reason you can't extract the section(s) in
> question using "objcopy --only-section" (e.g. as a raw binary file), and
> then
> use "strings" on the result?
>
> Jan
>

-- 

Re: readelf --string-dump analog for objdump

[Jan Beulich]

On 22.01.2024 13:11, Maxim Dementyev wrote:
> Thanks for pointing me out the objdump utility!
> Unfortunately, --only-section isn't a good choice: it produces all other
> information in the output file, not only the section in question.
> But I've found the need option of objdump utility: --dump-section
> Unfortunately, apart from this, again, the objdump utility creates a
> formatted file as an output, and I can add --only-section to reduce the
> size of it and redirect it to /dev/null.

But you're aware of objcopy's --output-target option, by using of which
you could have it produce a raw binary output file?

> So, this is usable with one intermediate file for a section.
> But it is much more complicated than just:
> "readelf -p section file | grep something".
> 
> And a possible solution (how to improve the objdump utility in a generic
> way) could be a special value for the --dump-section option to produce the
> output only for this section instead of redirecting it to a separate file:
> "objcopy --dump-section section=stdout | grep something"

Maybe. Plain "stdout" would be at risk of being ambiguous though. Then
again the use of '=' there is making the whole construct ambiguous
already, for '=' potentially (even if unlikely) being part of the
section name.

Jan

Re: readelf --string-dump analog for objdump

[Maxim Dementyev]

[-- Attachment #1: Type: text/plain, Size: 1028 bytes --]

On Mon, Jan 22, 2024 at 1:19 PM Jan Beulich <jbeulich@suse.com> wrote:

> On 22.01.2024 13:11, Maxim Dementyev wrote:
> > Unfortunately, apart from this, again, the objdump utility creates a
> > formatted file as an output, and I can add --only-section to reduce the
> > size of it and redirect it to /dev/null.
>
> But you're aware of objcopy's --output-target option, by using of which
> you could have it produce a raw binary output file?
>
> I'm using GNU objcopy (Gentoo 2.41 p4) 2.41.0.

There is no such a type for --output-target as raw
(invalid bfd target), only binary;
but this format produces a file with zero length.

At the same time, if I do not use this option,
by default it's elf64-x86-64 and the size is 816 bytes.

The file generated by --dump-section has the length
of 198 bytes, and this is all that I need,
no other stuff.

So I don't see how I can generate the same contents
without --dump-section option, just by pointing out some
other bfd format?

Regards,
Max

-- 

Re: readelf --string-dump analog for objdump

[Nick Clifton]

Hi Max,

> Is there any plans to implement a printable strings format for this case for the objdump utility?

No, but of course if you would like to write a patch to implement
such a feature we will be happy to review it.

> Or is there a solution without parsing the hexdump format and 
> restoring these printable strings?

I take it that you need to restrict the output to strings found in
just one section ?  (Otherwise you could use the "strings" tool).

Actually talking of the strings program it might be a lot easier
to augment this tool to restrict its output to a specified section.
It already has a function called strings_a_section() which decides
if a given section should be scanned.  It would not take much to
enhance this function to test for a named section...

Cheers
   Nick

Re: readelf --string-dump analog for objdump

[Maxim Dementyev]

[-- Attachment #1: Type: text/plain, Size: 1493 bytes --]

On Mon, Jan 22, 2024 at 6:42 PM Nick Clifton <nickc@redhat.com> wrote:

> > Or is there a solution without parsing the hexdump format and
> > restoring these printable strings?
>
> I take it that you need to restrict the output to strings found in
> just one section ?  (Otherwise you could use the "strings" tool).
>
> Actually talking of the strings program it might be a lot easier
> to augment this tool to restrict its output to a specified section.
> It already has a function called strings_a_section() which decides
> if a given section should be scanned.  It would not take much to
> enhance this function to test for a named section...
>

Thanks for your suggestions, Nick!

In fact, as Jan already mentioned, I can get the contents
of the named section with the help of
objcopy --dump-section secname=secoutfile ...

And I need redirect the output to null (I don't need it),
because I cannot get raw output for this section
by using --output-target, see my reply
https://sourceware.org/pipermail/binutils/2024-January/132041.html

This solutions needs an intermediate file in the comparison
with non-platform-independent solution, but more simple:
readelf -p secname | grep sometext

And I don't need the strings utility, because
I know the content of this section is a ASCII text with spaces
that was added with the command:
objcopy --add-section secname=secfile --set-section-flags
secname=noload,readonly ...

Regards,
Max


>

-- 

Re: readelf --string-dump analog for objdump

[Jan Beulich]

On 22.01.2024 18:19, Maxim Dementyev wrote:
> On Mon, Jan 22, 2024 at 1:19 PM Jan Beulich <jbeulich@suse.com> wrote:
> 
>> On 22.01.2024 13:11, Maxim Dementyev wrote:
>>> Unfortunately, apart from this, again, the objdump utility creates a
>>> formatted file as an output, and I can add --only-section to reduce the
>>> size of it and redirect it to /dev/null.
>>
>> But you're aware of objcopy's --output-target option, by using of which
>> you could have it produce a raw binary output file?
>>
>> I'm using GNU objcopy (Gentoo 2.41 p4) 2.41.0.
> 
> There is no such a type for --output-target as raw
> (invalid bfd target), only binary;
> but this format produces a file with zero length.

Not for me. Did you specify -j <section> for the tool to know
what to copy?

> At the same time, if I do not use this option,
> by default it's elf64-x86-64 and the size is 816 bytes.

Of course.

> The file generated by --dump-section has the length
> of 198 bytes, and this is all that I need,
> no other stuff.

Well, if that is what you need, then I see no problem with you
going this route. I merely wanted to point out that there is an
alternative. (I was actually surprised when I first saw
--dump-section, as that looks to me like merely shorthand for the
-O / -j combination.)

Jan