Re: Working with ELF already loaded in memory

[Mark Wielaard <mark@klomp.org>]

Hi Sonal,

On Fri, 2021-07-09 at 05:34 +0000, Sonal Santan wrote:
> 
> Thanks for the pointer. I was looking for APIs inside
> /usr/include/elfutils directory and
> did not realize elfutils also places header files under /usr/include
> directory. I am working 
> with this API now.

Ah, yes, the libelf library is kind of "standard" (it is also available
on BSDs, AIX, Solaris, etc.) so it goes under /usr/include. The libdw
library places its headers under
/usr/include/elfutils/{libdw.h,libdwelf.h,libdwfl.h}.

> > You can also use libdwfl (part of libdw) to do some of the above automagically.
> > See for example:
> > 
> > /* Call dwfl_report_module for each file mapped into the address space of PID.
> >    Returns zero on success, -1 if dwfl_report_module failed,
> >    or an errno code if opening the proc files failed.  */ extern int
> > dwfl_linux_proc_report (Dwfl *dwfl, pid_t pid);
> 
> Does this also work for ELF files which are loaded into heap as blob -- not really
> _mapped_ into the address space? I guess I will have to provide some hints to dwfl
> so it can locate the loaded blob when walking through the process map?

It probably wouldn't work if the the library is not normally mapped
into memory since it relies on the content of /proc/<pid>/map to locate
what is mapped where. You can also create your own and use:

/* Similar, but reads an input stream in the format of Linux
/proc/PID/maps
   files giving module layout, not the file for a live process.  */
extern int dwfl_linux_proc_maps_report (Dwfl *dwfl, FILE *);

But there are also more specific interfaces to map segments to modules
in libdwfl.h. They don't have to be file mapped, but can also come for
memory or parts of a file (see for example the core file mapper). But
these interfaces are a little obscure with minimal documentation.
Please feel free to ask for more background if you get stuck.

Cheers,

Mark