Using dwarf_getfuncs to get function from object stored in memory

Using dwarf_getfuncs to get function from object stored in memory

[Jeff Lin]

Hi,

I’ve written code to extract function from a shared object with dwarf_begin api that finds the dwarf objects with the file descriptor using dwarf_getfuncs.
However, when I tried to parse the same object that is loaded into memory first, dwarf_getfuncs is not able to get the function.
In the case of accessing the object that is in memory, I used the following line to get the dwarf object:
  Elf *ehandle = elf_memory(const_cast<char *>(so_file), size);
  Dwarf *dw = dwarf_begin_elf(ehandle, DWARF_C_READ, NULL);

I am able to get the offset and tag with dwarf_nextcu, but errors out with dwarf_getfuncs.
Does anyone know why dwarf_getfuncs does return properly when trying to process dwarf object that was store in memory?

Thanks,
-Jeff
This email and any attachments are intended for the sole use of the named recipient(s) and contain(s) confidential information that may be proprietary, privileged or copyrighted under applicable law. If you are not the intended recipient, do not read, copy, or forward this email message or any attachments. Delete this email message and any attachments immediately.

Re: Using dwarf_getfuncs to get function from object stored in memory

[Mark Wielaard]

Hi Jeff,

On Tue, Aug 17, 2021 at 03:40:08AM +0000, Jeff Lin via Elfutils-devel wrote:
> I’ve written code to extract function from a shared object with
> dwarf_begin api that finds the dwarf objects with the file
> descriptor using dwarf_getfuncs.  However, when I tried to parse the
> same object that is loaded into memory first, dwarf_getfuncs is not
> able to get the function.  In the case of accessing the object that
> is in memory, I used the following line to get the dwarf object:
>
>   Elf *ehandle = elf_memory(const_cast<char *>(so_file), size);
>   Dwarf *dw = dwarf_begin_elf(ehandle, DWARF_C_READ, NULL);
> 
> I am able to get the offset and tag with dwarf_nextcu, but errors
> out with dwarf_getfuncs.  Does anyone know why dwarf_getfuncs does
> return properly when trying to process dwarf object that was store
> in memory?

If the ELF in memory is the same as the ELF on disk I don't know why
dwarf_getfuncs would work differently. Does the callback get called?
Does dwarf_getfuncs return -1? What does dwarf_errmsg say?

Cheers,

Mark

Re: Using dwarf_getfuncs to get function from object stored in memory

[Jeff Lin]

Hi Mark,

I tracked down the issue to the copy in memory was actually different.  
However, because dwarf_begin_elf was still providing the offset to the top cus, I did not suspect that was the issue.
Dwarf_getfuncs did return -1, but I did not look at dwarf_errmsg.  
After I ensured the copy in memory is an exact copy, everything worked.

Thanks,
-Jeff

On 8/23/21, 2:01 PM, "Mark Wielaard" <mark@klomp.org> wrote:

    CAUTION: This message has originated from an External Source. Please use proper judgment and caution when opening attachments, clicking links, or responding to this email.


    Hi Jeff,

    On Tue, Aug 17, 2021 at 03:40:08AM +0000, Jeff Lin via Elfutils-devel wrote:
    > I’ve written code to extract function from a shared object with
    > dwarf_begin api that finds the dwarf objects with the file
    > descriptor using dwarf_getfuncs.  However, when I tried to parse the
    > same object that is loaded into memory first, dwarf_getfuncs is not
    > able to get the function.  In the case of accessing the object that
    > is in memory, I used the following line to get the dwarf object:
    >
    >   Elf *ehandle = elf_memory(const_cast<char *>(so_file), size);
    >   Dwarf *dw = dwarf_begin_elf(ehandle, DWARF_C_READ, NULL);
    >
    > I am able to get the offset and tag with dwarf_nextcu, but errors
    > out with dwarf_getfuncs.  Does anyone know why dwarf_getfuncs does
    > return properly when trying to process dwarf object that was store
    > in memory?

    If the ELF in memory is the same as the ELF on disk I don't know why
    dwarf_getfuncs would work differently. Does the callback get called?
    Does dwarf_getfuncs return -1? What does dwarf_errmsg say?

    Cheers,

    Mark