Re: Working with ELF already loaded in memory

[Mark Wielaard <mark@klomp.org>]

Hi Sinal,

On Thu, 2021-07-08 at 05:02 +0000, Sonal Santan via Elfutils-devel
wrote:
> Going through the libdw it appears that all APIs require either a
> file handle or a file name of the ELF object to create a session.
> Since we do not have access to the ELF file -- but rather the ELF
> file contents are already loaded in memory -- is there any other
> mechanism to create a session for extracting DWARF information using
> libdw? 

Yes, if you just need the information already loaded into memory and
you know where the library is mapped you can use:

/* Create descriptor for memory region.  */
extern Elf *elf_memory (char *__image, size_t __size);

You can then use that Elf handle to extract the information that has
been mapped in. Which often is not the actual debug information though.

If you have a Elf handle you can use:

/* Returns the build ID as found in a NT_GNU_BUILD_ID note from either
   a SHT_NOTE section or from a PT_NOTE segment if the ELF file
   doesn't contain any section headers.  On success a pointer to the
   build ID is written to *BUILDID_P, and the positive length of the
   build ID is returned.  Returns 0 if the ELF lacks a NT_GNU_BUILD_ID
   note.  Returns -1 in case of malformed data or other errors.  */
extern ssize_t dwelf_elf_gnu_build_id (Elf *elf, const void **build_idp);

You can then use the build_id to lookup the debug information (file).

You can also use libdwfl (part of libdw) to do some of the above
automagically. See for example:

/* Call dwfl_report_module for each file mapped into the address space of PID.
   Returns zero on success, -1 if dwfl_report_module failed,
   or an errno code if opening the proc files failed.  */
extern int dwfl_linux_proc_report (Dwfl *dwfl, pid_t pid);

The Dwfl will then be a representation of the modules (executable and
shared libraries) of that particular process. You can then iterate
through those modules using dwfl_getmodules and get a Dwarf handle
using dwfl_module_getdwarf (or for all with dwfl_getdwarf). libdw will
then try to extract that build-id from each module and try various
lookups to get the (separate on disk) debuginfo.

Hope that helps,

Mark