1.4. Tools
Peering into the world of object files is made easier using the tools:
objdump,
nm, and
readelf
1.4.1. "objdump -t" output format
I often dump the symbols of a file using objdump -t. I can't seem to easily locate any documentation on the output format so I've included some quick notes here. A typical use of this tool would look something like the following:
[trevor]$ objdump -t add.o
add.o: file format elf32-i386
SYMBOL TABLE:
00000000 l df *ABS* 00000000 add.c
00000000 l d .text 00000000
00000000 l d .data 00000000
00000000 l d .bss 00000000
00000000 l d .comment 00000000
00000000 g F .text 0000000b add
|
Here is my understanding of the column descriptions. This information comes from browsing through bfd/syms.c:bfd_print_symbol_vandf() (where "vandf" stands for "value and flags").
The flags which are described above are part of a larger set of symbols and attributes which are defined in bfd/bfd.h. The entire set of flags (or attributes) and their meanings are given below.
 | Notice that objdump -t doesn't try to display the values of all the possible flags, just the ones mentioned above. |
Table 1-1. BSF_ flags/attributes
| Definition | � | Symbol | Description |
|---|---|---|---|
| 0x00000 | � | BSF_NO_FLAGS | placeholder for no defined flags |
| 0x00001 | � | BSF_LOCAL | The symbol has local scope (i.e. a static in C). VALUE(1) is this symbol's offset into the data section. |
| 0x00002 | � | BSF_GLOBAL | The symbol has global scope (i.e. initialized data in C). VALUE(2) is this symbol's offset into the data section. |
| BSF_GLOBAL | � | BSF_EXPORT | This symbol has global scope and is exported. Same as BSF_GLOBAL. |
| 0x00008 | � | BSF_DEBUGGING | The symbol is a debugging record. The VALUEs are arbitrary, unless BSF_DEBUGGING_RELOC is set. |
| 0x00010 | ELF | BSF_FUNCTION | Function entry point. |
| 0x00020 | � | BSF_KEEP | used by the linker |
| 0x00040 | � | BSF_KEEP_G | |
| 0x00080 | � | BSF_WEAK | Weak global symbol. This symbol is overridable (without warning) by a regular global symbol of the same name. |
| 0x00100 | ELF | BSF_SECTION_SYM | This symbol points to a section. |
| 0x00200 | � | BSF_OLD_COMMON | This symbol used to be *COM*, but is now allocated. |
| 0x00400 | COFF | BSF_NOT_AT_END | This symbol appears where it is declared and not at the end of a section. |
| 0x00800 | � | BSF_CONSTRUCTOR | This symbol indicates the start of the constructor section. |
| 0x01000 | � | BSF_WARNING | The presence of this symbol acts to indicate that there is a warning on the next symbol. |
| 0x02000 | � | BSF_INDIRECT | This symbol is an indirect pointer to the symbol with the same name as the next symbol. |
| 0x04000 | ELF | BSF_FILE | This symbol contains a filename. |
| 0x08000 | ELF | BSF_DYNAMIC | This symbol is associated with dynamic linking. |
| 0x10000 | ELF | BSF_OBJECT | This symbol denotes a data object. |
| 0x20000 | � | BSF_DEBUGGING_RELOC | This is a debugging symbol. VALUE(1) is the offset into the data section. BSF_DEBUGGING should be set too. |
| 0x40000 | ELF | BSF_THREAD_LOCAL | This symbol is used for thread local storage. |