ELF binarry

ELF binarry

[ssams sudin]

with GDB or another debugger, can we look at highest memory address of ELF binarry.
if yes what is the command ?
where can i found some reference about it?

forgive me if this subject out of topic or just repeating last post
regard
ssams
-- 
______________________________________________
Check out the latest SMS services @ http://www.linuxmail.org 
This allows you to send and receive SMS through your mailbox.


Powered by Outblaze

Re: ELF binarry

[Brian Raiter]

> with GDB or another debugger, can we look at highest memory address
> of ELF binarry.  if yes what is the command ?  where can i found
> some reference about it?

No, there is no gdb command for finding that.

For a typical ELF binary under Linux, the highest valid memory address
will be the space just above the top of the stack, 0xBFFFFFFF. This
space is used to stash the argv and envp array. The stack starts just
before that and grows downward. The actual program and other read-only
sections will be loaded at 0x08048000, followed by the read-write
sections and then the heap. Shared-object libraries tend to be loaded
from 0x40000000 on up.

None of this is written in stone, of course. But the vast majority of
Linux ELF binaries are laid out in this way.

Do be aware that just because 0xBFFFFFFF is valid doesn't mean that
every memory address less than that will be valid. In fact, most of
them won't be.

b

Re: ELF binarry

[Frederic Marmond]

ssams sudin wrote:

>with GDB or another debugger, can we look at highest memory address of ELF binarry.
>if yes what is the command ?
>where can i found some reference about it?
>
>forgive me if this subject out of topic or just repeating last post
>regard
>ssams
>  
>

You may find usefull to see all infos about your elf with the 'readelf' 
tool.
$ readelf -a /bin/dd
will display a lot of interesting thing about where is what (but it is 
oriented to shared libraries though...)

It is usefull to see the basic organisation of a program, before 
starting debug it.

Fred

Re: ELF binarry

[Brian Raiter]

> So, how can we get memory info (start & finish) from argv, envp, and
> programname..?

Just look at them in the debugger:

$ gdb ./foo
GNU gdb [... blah blah blah ...]
(gdb) b main
Breakpoint 1 at 0x8048433: file foo.c, line 6.
(gdb) r
Starting program: ./foo 
Breakpoint 1, main (argc=1, argv=0xbffff584, envp=0xbffff58c) at foo.c:6
(gdb) p argv[0]
$1 = 0xbffff698 "./foo"
(gdb) p envp[0]
$2 = 0xbffff6ad "VISUAL=/usr/bin/emacs"
(gdb) p envp[31]
$3 = 0xbfffffd9 "HISTSIZE=1000"

et cetera, et cetera ...

b