Logo Questions Linux Laravel Mysql Ubuntu Git Menu
 

How to undo strip - i.e. add symbols back to stripped binary

I have a stripped binary and symbol-file. Is it possible to add the symbols back to binary and create an unstripped binary.

My use-case is using this binary w/ valgrind.

like image 777
cached Avatar asked Apr 12 '13 18:04

cached


People also ask

How do you remove binary symbols?

To remove debugging symbols from a binary (which must be an a. out or ELF binary), run strip --strip-debug filename. Wildcards can be used to treat multiple files (use something like strip --strip-debug $LFS/tools/bin/*).

What does the strip command do?

Description. The strip command reduces the size of XCOFF object files. The strip command optionally removes the line number information, relocation information, the debug section, the typchk section, the comment section, file headers, and all or part of the symbol table from the XCOFF object files.

What does strip do in linux?

strip is a GNU utility to "strip" symbols from object files. This is useful for minimizing their file size, streamlining them for distribution. It can also be useful for making it more difficult to reverse-engineer the compiled code.


3 Answers

For those tools that do not support separate files for debug information, you can glue the debug sections back to the original binary.

You can do something along these lines, for example:

  • First build a small program that efficiently extracts an arbitrary chunk from a file

    (note that dd will not do this efficiently as we'd have to use bs=1 to support an arbitrary offset and length, and objcopy -O binary does not copy sections that are not ALLOC, LOAD※)

    cat <<EOF | gcc -xc -o ./mydd - #include <errno.h> #include <fcntl.h> #include <stdio.h> #include <stdlib.h> #include <sys/stat.h> #include <unistd.h> #include <macros.h>  char buf[1024*1024];  int main(int argc, char** argv) {   char    *fin, *fout;   int     fdin, fdout;   off_t   off;   size_t  len;   ssize_t rd;   int     status;    if (argc != 5) {     fprintf(stderr, "Usage: %s fin skip count fout\n", argv[0]);     return 1;   }    fin   = argv[1];   off   = strtoul(argv[2], NULL, 0);   len   = strtoul(argv[3], NULL, 0);   fout  = argv[4];   fdin  = -1;   fdout = -1;    if ((fdin  = open(fin,  O_RDONLY)) < 0) {     status = errno;     perror(fin);   } else if ((fdout = open(fout, O_WRONLY|O_TRUNC|O_CREAT, 0660)) < 0) {     status = errno;     perror(fout);   } else if (lseek(fdin, off, SEEK_SET) == (off_t)-1) {     status = errno;     perror("Seeking input");   } else {     while (len > 0 && (rd = read(fdin, buf, min(len, sizeof(buf)))) > 0) {       if (write(fdout, buf, rd) != rd) {         /*don't bother with partial writes or EINTR/EAGAIN*/         status = errno;         perror(fin);         break;       }       len -= rd;     }     if (rd < 0) {       status = errno;       perror(fin);     }   }   if (fdin >= 0)  close(fdin);   if (fdout >= 0) close(fdout);   return status; } EOF 
  • Finally, extract the .debug sections and glue them to the stripped binary.

    objcopy `     objdump -h program.dbg  |     awk '$2~/^\.debug/' |     while read idx name size vma lma off algn ; do         echo "$name" >&2         echo " --add-section=$name=$name.raw"         ./mydd program.dbg 0x$off 0x$size $name".raw"     done ` program program_with_dbg 
like image 152
vladr Avatar answered Sep 21 '22 19:09

vladr


Valgrind supports separate debug files, so you should use the answer here, and valgrind should work properly with the externalized debug file.

like image 23
Petesh Avatar answered Sep 25 '22 19:09

Petesh


elfutils comes with the tool eu-unstrip which can be used to merge symbol files with executables. The result can then be used in place of the stripped version.

like image 33
the8472 Avatar answered Sep 23 '22 19:09

the8472