Home Original page

restoring archive from execuable

Pavel Roskin proski@gnu.org
Fri Oct 24 15:54:00 GMT 2003 
On Fri, 24 Oct 2003, Nicolae Mihalache wrote:

> Pavel Roskin wrote:
>
> >I believe you are use it if you have relocation records.  Try "objdump -r"
> >on it.  Otherwise it's probably impossible unless you make some kind of
> >custom relocator that would load the original object code at the address
> >it was configured to use.
> >
> Ok, I'm on the list now.
> I tried to run "objdump -r", the results are not very encouraging:
> exgse /tmp> objdump -r mon
>
> mon:     file format elf32-i386
>
> Could you please point me to a document explaining how all these things
> work? In my ignorance I thought that a library is simply a collection of
> function code that is copied into the executable at linking time and
> moving them back in a library means only to know where exactly they have
> been copied. Now, I realise that they can not be copied just like that,

Google is your friend.  Among first hits are manuals for gnu ld and the
elf format:

http://www.gsp.com/cgi-bin/man.cgi?section=1&topic=ld
http://www.gsp.com/cgi-bin/man.cgi?section=5&topic=elf

> the memory addresses that are used inside the objects have somehow to be
> changed to fit with the memory addresses used in the executable.

That's right.  When an executable is created, that information is
discarded by default for platforms that allow to load every executable
at the address it wants to use.  To keep that information in the
executable use "-q" with gnu ld or "-Wl,-q" with gcc.

I think there are few tricks things that can be used, but I'm afraid you
are on your own with all that hacking:

Use dlopen() on the binary.  This may work if it exports the symbols you
need.

Run the original executable to use LD_PRELOAD to load a library that would
intercept some calls and redirect then to the new code.

Disassemble the binary, extract the functions you need and use them.
Check the code for references to other sections.  Absolute addresses need
to be replaced.

-- 
Regards,
Pavel Roskin
More information about the Binutils mailing list