Jarkko Sakkinen
Posts
4497Following
316Followers
475OpenPGP: 3AB05486C7752FE1
Jarkko Sakkinen
jarkko
I've said how great the Scanner app in #GNOME is when having to scan multi dozen contract papers for instance but also one nice I noticed in Evince: images can be exported by simply right-clicking the image. I've used weird command-line spells and never noticed this before.
0
1
1
Jarkko Sakkinen
jarkko
Military command-and-control:
1. US: IRC and Matrix
2. Russia: Discord
True story
1. US: IRC and Matrix
2. Russia: Discord
True story
0
0
0
@osandov Thanks this cleared the picture a lot! DWARF is pretty complex to find attachment points when you first start looking into it so this kind of information is gold ATM. Thank you.
1
0
2
@gimulnautti I saw while ago recent interview from John Carmack where he explained why he actually needs IDE and I fully grabbed that.
0
0
0
@vathpela Yeah, I found myself fixing DWARF post-processor bugs with zero previous experience and for rustc RISC-V target that exist only in the nightly, and finally with a custom target JSON file with modifications how relocations are handled etc.
At least it was a jump start to a new job :-)
Spent literally few nights with the spec, code and not understanding anything at all but now I got some grip how to analyze it :-)
Of tools my experience is this so far:
- drarfdump and llvm-dwarfdump work with somewhat variable success rate unless the arch is something established as x86.
- readelf --debug-dump=<sections> can be worth of trying because it can sometimes succeed where dwarfdump fails.
- Of all tools the only tool that has pretty much nailed any file I've thrown to it has been rz-bin: https://book.rizin.re/src/tools/rz-bin/intro.html.
It is actually topic still that I would want be knowledgeable of, so no complains. Kind of spot in binary I've been too scared to touch before :-)
At least it was a jump start to a new job :-)
Spent literally few nights with the spec, code and not understanding anything at all but now I got some grip how to analyze it :-)
Of tools my experience is this so far:
- drarfdump and llvm-dwarfdump work with somewhat variable success rate unless the arch is something established as x86.
- readelf --debug-dump=<sections> can be worth of trying because it can sometimes succeed where dwarfdump fails.
- Of all tools the only tool that has pretty much nailed any file I've thrown to it has been rz-bin: https://book.rizin.re/src/tools/rz-bin/intro.html.
It is actually topic still that I would want be knowledgeable of, so no complains. Kind of spot in binary I've been too scared to touch before :-)
0
0
0
Example inlined entry:
<0x491fc>: Abbrev Number: 51 (DW_TAG_inlined_subroutine)
DW_AT_abstract_origin [DW_FORM_ref4] : <0x4cab0>
DW_AT_low_pc [DW_FORM_addr] : 0x0
DW_AT_high_pc [DW_FORM_data4] : 0
DW_AT_call_file [DW_FORM_data1] : 6
DW_AT_call_line [DW_FORM_data1] : 232
DW_AT_call_column [DW_FORM_data1] : 38
Origin:
<0x4cab0>: Abbrev Number: 36 (DW_TAG_subprogram)
DW_AT_linkage_name [DW_FORM_strp] : (indirect string, .debug_str+0x0): PRIME_VALIDATOR_DATA
DW_AT_name [DW_FORM_strp] : (indirect string, .debug_str+0x0): PRIME_VALIDATOR_DATA
DW_AT_decl_file [DW_FORM_data1] : 27
DW_AT_decl_line [DW_FORM_data1] : 247
DW_AT_type [DW_FORM_ref4] : <0xe9d>
DW_AT_inline [DW_FORM_data1] : 1
Files matching numbers can be found for instance llvm-dwarfdump -debug-line <file>
<0x491fc>: Abbrev Number: 51 (DW_TAG_inlined_subroutine)
DW_AT_abstract_origin [DW_FORM_ref4] : <0x4cab0>
DW_AT_low_pc [DW_FORM_addr] : 0x0
DW_AT_high_pc [DW_FORM_data4] : 0
DW_AT_call_file [DW_FORM_data1] : 6
DW_AT_call_line [DW_FORM_data1] : 232
DW_AT_call_column [DW_FORM_data1] : 38
Origin:
<0x4cab0>: Abbrev Number: 36 (DW_TAG_subprogram)
DW_AT_linkage_name [DW_FORM_strp] : (indirect string, .debug_str+0x0): PRIME_VALIDATOR_DATA
DW_AT_name [DW_FORM_strp] : (indirect string, .debug_str+0x0): PRIME_VALIDATOR_DATA
DW_AT_decl_file [DW_FORM_data1] : 27
DW_AT_decl_line [DW_FORM_data1] : 247
DW_AT_type [DW_FORM_ref4] : <0xe9d>
DW_AT_inline [DW_FORM_data1] : 1
Files matching numbers can be found for instance llvm-dwarfdump -debug-line <file>
1
0
0
This is actually nothing too complicated if got it right:
1. DW_TAG_subprogram: contains data to connect tag to the source file locations of a function implemention.
2. DAW_TAG_inlined_subroutine: open coded (inlined) subprogram. Probably can be also for inlined subprogram (by optimizer or something) without DW_AT_inline set to 1. Contains offset in debug_info in the attribute DW_AT_abstract_origin referring to the subprogram that is inlined.
3. Out-of-line inlined subroutines have entry points i.e. are like clones of functions. They are tagged as DW_TAG_subprogram but have DW_AT_abstract_origin containing the reference to the root subprogram.
Something along lines of this....
1. DW_TAG_subprogram: contains data to connect tag to the source file locations of a function implemention.
2. DAW_TAG_inlined_subroutine: open coded (inlined) subprogram. Probably can be also for inlined subprogram (by optimizer or something) without DW_AT_inline set to 1. Contains offset in debug_info in the attribute DW_AT_abstract_origin referring to the subprogram that is inlined.
3. Out-of-line inlined subroutines have entry points i.e. are like clones of functions. They are tagged as DW_TAG_subprogram but have DW_AT_abstract_origin containing the reference to the root subprogram.
Something along lines of this....
2
0
0
Jarkko Sakkinen
jarkko
@gimulnautti naah, not my cup of tea tbh :-) i get tho why someone would want to use this, not bad either
1
0
1
Jarkko Sakkinen
jarkko
Speaking of DWARF:
1. Out-of-line instance of an inlined subroutine.
2. Concrete instance of an inlined subroutine.
What is their difference put in some common sense terms? I'm dealing at work with a custom DWARF post-processor and have a hunch that grabbing this would help me to sort out a bug that I'm dealing with.
#DWARF #GCC #LLVM
1. Out-of-line instance of an inlined subroutine.
2. Concrete instance of an inlined subroutine.
What is their difference put in some common sense terms? I'm dealing at work with a custom DWARF post-processor and have a hunch that grabbing this would help me to sort out a bug that I'm dealing with.
#DWARF #GCC #LLVM
1
0
1
Jarkko Sakkinen
jarkko
1
0
1
Jarkko Sakkinen
repeated
repeated
Sy Brand
TartanLlama@mastodon.socialThe whole of my book on Building a Debugger is now available on Early Access!
It teaches you how to write a native code debugger from scratch.
There's lots of cats.
4
11
3
Jarkko Sakkinen
jarkko
@TartanLlama For me having chapters on DWARF and stack unwinding are definitely buy-ins. I think I commented something stupid on earlier post on this book but does not matter, going to get this :-) Need to deal with DWARF at work ATM so getting other peoples perspective on topic is always useful (and worth of money).
0
0
1
Jarkko Sakkinen
jarkko
1
0
1
@kev nice collection bro! i became wrist watch owner year ago (g-shock model with bluetooth) after over 20 years break because i had this dilemma:
1. I absolutely hate all smartphones in existence.
2. All these activation schemes enforce me to have one.
So I have my iPhone SE mostly in the drawer and from my wrist watch I see if there is new SMS and stuff I generally want to see :-)
1. I absolutely hate all smartphones in existence.
2. All these activation schemes enforce me to have one.
So I have my iPhone SE mostly in the drawer and from my wrist watch I see if there is new SMS and stuff I generally want to see :-)
0
0
1
@ljs We've never been worried, we've only prepared since WW 2 🤷 I guess that was one reason why Finland transition to NATO was so fast, as we already have a huge military budget (latest purchase was David's Sling air defense system from Israel). It has kept peace on the east border...
1
0
2