Question

我正在翻转使用-static编译的x64 ELF文件，它似乎被剥离了。因此，当我在GDB中运行它时，没有任何符号。我可以恢复这些符号吗？或者做些什么来使它更容易？

objdump -tT 6dd 
6dd:     file format elf64-x86-64
objdump: 6dd: not a dynamic object
SYMBOL TABLE:
no symbols
DYNAMIC SYMBOL TABLE:
no symbols
Entry point: 0x401058
    0x0000000000400190 - 0x00000000004001b0 is .note.ABI-tag
    0x00000000004001b0 - 0x00000000004001d4 is .note.gnu.build-id
    0x00000000004001d8 - 0x00000000004002f8 is .rela.plt
    0x00000000004002f8 - 0x0000000000400310 is .init
    0x0000000000400310 - 0x00000000004003d0 is .plt
    0x00000000004003d0 - 0x00000000004f1b78 is .text
    0x00000000004f1b80 - 0x00000000004f339c is __libc_freeres_fn
    0x00000000004f33a0 - 0x00000000004f3448 is __libc_thread_freeres_fn
    0x00000000004f3448 - 0x00000000004f3456 is .fini
    0x00000000004f3460 - 0x0000000000511424 is .rodata
    0x0000000000511428 - 0x0000000000511430 is __libc_atexit
    0x0000000000511430 - 0x0000000000511488 is __libc_subfreeres
    0x0000000000511488 - 0x0000000000511490 is __libc_thread_subfreeres
    0x0000000000511490 - 0x0000000000527174 is .eh_frame
    0x0000000000527174 - 0x00000000005272f6 is .gcc_except_table
    0x0000000000727ef0 - 0x0000000000727f10 is .tdata
    0x0000000000727f10 - 0x0000000000727f48 is .tbss
    0x0000000000727f10 - 0x0000000000727f18 is .init_array
    0x0000000000727f18 - 0x0000000000727f20 is .fini_array
    0x0000000000727f20 - 0x0000000000727f30 is .ctors
    0x0000000000727f30 - 0x0000000000727f40 is .dtors
    0x0000000000727f40 - 0x0000000000727f48 is .jcr
    0x0000000000727f50 - 0x0000000000727fd0 is .data.rel.ro
    0x0000000000727fd0 - 0x0000000000727fe0 is .got
    0x0000000000727fe8 - 0x0000000000728060 is .got.plt
    0x0000000000728060 - 0x0000000000729890 is .data
    0x00000000007298a0 - 0x000000000072cbe8 is .bss
    0x000000000072cbf0 - 0x000000000072cc38 is __libc_freeres_ptrs

Answer 1

简短回答：不。

您需要获取源并重新编译以生成调试二进制文件。

如何反转剥离的ELF编译-static？

1 个答案: