How does eu_unstrip restore symbols

How does eu_unstrip restore symbols

[Fr3v1]

[-- Attachment #1: Type: text/plain, Size: 528 bytes --]

Hi there, I want to get the function names and addresses of a large amount
of stripped binaries of Linux packages. The present approach is to restore
symbol names by using 'eu_unstrip' and the .debug file within the
corresponding .ddeb file.
So here are my two questions: 1. Is there another way to get the function
names and their addresses? 2. How does eu_unstirp work, does it really make
stripped one 'unstrip'? Will it occur to some kind of precision error 3.
How fast is it for like 10 million tiny binaries?

Best wishes

Re: How does eu_unstrip restore symbols

[Mark Wielaard]

Hi Fr3v1,

On Thu, 2023-06-29 at 18:09 +0800, Fr3v1 via Elfutils-devel wrote:
> Hi there, I want to get the function names and addresses of a large amount
> of stripped binaries of Linux packages. The present approach is to restore
> symbol names by using 'eu_unstrip' and the .debug file within the
> corresponding .ddeb file.

After you done that, which information on the functions do you extract
and how do you do that? How do you store this information and what is
it being used for?

> So here are my two questions: 1. Is there another way to get the function
> names and their addresses?

You can run eu-readelf -s on both the main executable and the .debug
file. The main executable will at least contain the .dynsym symbols,
the .debug file will have the .symtab symbols in most cases.

>  2. How does eu_unstirp work, does it really make
> stripped one 'unstrip'?

Yes, that how it works, it merges the sections from the main executable
and the separate debug file into one as it was before separating them.

>  Will it occur to some kind of precision error 3.
> How fast is it for like 10 million tiny binaries?

I think you will have to measure that yourself.

Cheers,

Mark