5aLIVE
April 20th, 2010, 13:36
I recently compiled some C++ code using GCC 3.4.5 (it's old I know), I made a debug release so that it would include symbol info.
If I load the file into IDA Pro, I don't see the usual prompt informing me that the binary includes symbol info which you would do if if were compiled with MSVC for example.
The same is true when with OllyDbg, there are no symbols to be seen in the disassembled code view.
Hmm, I've just noticed that Olly doesn't display symbols for my test file compiled with MSVC 6 either
I've taken a look at the plethora of options and settings in both Olly and IDA which didn't help much.
Google searching didn't give me any clues either.
Is anyone able to tell me if this is because Olly and IDA don't support GCC compiled symbol data? Maybe uses a different format or something? Or indeed something else I haven't considered?
Better still, if anyone knows how to fix this or could suggest a few ideas to try that would be most appreciated.
Update #1: I tried using the object scanner tool in Olly which fails to work for some reason. I added various object files from the debug release and it is unable to find a single match. Loading the same object files into IDA the expected symbols can be seen okay.
Update #2: CFF Explorer and Lord PE shows that the Debug directory is reported as being empty even though the debug release is approximately 7 times the size of the symbol stripped release version.
Update #3: I loaded my test file into GDB and typed the following command:
maint print symbols my_symbols.txt
This should write a dump of the debugging symbol data into the filename my_symbols.txt.
The file contains no data at all would suggest that the GCC compiler switch [-g] isn't
producing debugging symbols for some reason. I'm not quite sure what else I can
try, any ideas?
Round and round I go... Okay, typing maint print msymbols my_symbols.txt
will produce a dump of current partial symbol definitons to the my_symbols.txt file.
So the symbol data is there afterall.
Here's a little snippet from the resulting file:
My thinking at this time is that this debug data must be stored in the .stab and stabstr
sections of the executable as I remember reading a reference made to the stabs-in-
COFF format when GDB reads symbol table data.
Is this likely to be the source of the problem as I had first intitially suggested? i.e., the
stab-in-COFF symbol table format is not supported by the likes of IDA or OllyDbg?
What to do?
Update #4: I've just been looking through some of the GDBs support commands and I found
that I can view all the function names by typing info functions. I'm not sure with this is symbol info or not can any clarify this for me please?
Thank you,
5aLIVE.
PS. Nice job on the new look of the forum.
If I load the file into IDA Pro, I don't see the usual prompt informing me that the binary includes symbol info which you would do if if were compiled with MSVC for example.
The same is true when with OllyDbg, there are no symbols to be seen in the disassembled code view.
Hmm, I've just noticed that Olly doesn't display symbols for my test file compiled with MSVC 6 either
I've taken a look at the plethora of options and settings in both Olly and IDA which didn't help much.
Google searching didn't give me any clues either.
Is anyone able to tell me if this is because Olly and IDA don't support GCC compiled symbol data? Maybe uses a different format or something? Or indeed something else I haven't considered?
Better still, if anyone knows how to fix this or could suggest a few ideas to try that would be most appreciated.
Update #1: I tried using the object scanner tool in Olly which fails to work for some reason. I added various object files from the debug release and it is unable to find a single match. Loading the same object files into IDA the expected symbols can be seen okay.
Update #2: CFF Explorer and Lord PE shows that the Debug directory is reported as being empty even though the debug release is approximately 7 times the size of the symbol stripped release version.
Update #3: I loaded my test file into GDB and typed the following command:
maint print symbols my_symbols.txt
This should write a dump of the debugging symbol data into the filename my_symbols.txt.
The file contains no data at all would suggest that the GCC compiler switch [-g] isn't
producing debugging symbols for some reason. I'm not quite sure what else I can
try, any ideas?
Round and round I go... Okay, typing maint print msymbols my_symbols.txt
will produce a dump of current partial symbol definitons to the my_symbols.txt file.
So the symbol data is there afterall.
Here's a little snippet from the resulting file:
Code:
[678] T 0x435098 _ZN12GfxResourcesD2Ev GfxResources::~GfxResources()
[679] T 0x435112 _ZN12GfxResourcesD1Ev GfxResources::~GfxResources()
[680] T 0x43518c _ZN12GfxResources10lookupFontEPc GfxResources::lookupFont(char*)
[681] T 0x4351fe _ZN12GfxResources13lookupXObjectEPcP6Object GfxResources::lookupXObject(char*, Object*)
[682] T 0x435290 _ZN12GfxResources15lookupXObjectNFEPcP6Object GfxResources::lookupXObjectNF(char*, Object*)
[683] T 0x435322 _ZN12GfxResources16lookupColorSpaceEPcP6Object GfxResources::lookupColorSpace(char*, Object*)
My thinking at this time is that this debug data must be stored in the .stab and stabstr
sections of the executable as I remember reading a reference made to the stabs-in-
COFF format when GDB reads symbol table data.
Is this likely to be the source of the problem as I had first intitially suggested? i.e., the
stab-in-COFF symbol table format is not supported by the likes of IDA or OllyDbg?
What to do?
Update #4: I've just been looking through some of the GDBs support commands and I found
that I can view all the function names by typing info functions. I'm not sure with this is symbol info or not can any clarify this for me please?
Thank you,
5aLIVE.
PS. Nice job on the new look of the forum.
