For ELF binaries on Linux, if the executable is not stripped, it is possible to recover memory locations of location variables in the form of relative addresses to stack/frame pointer? As an example, if a C program contains an integer variable var in function main, is there any means to associate its address on stack, say [rbp-0x18] to the source variable itself?
Add a comment
|
2 Answers
Let's start first with finding local variables. Binary files contain multiple sections used for a plethora of purposes. The section of interest in your case is the .bss. In this sections, you're supposed to find a reference to the local variables used by your program.
Now, regarding the variable name, the only way to associate it to a relative address is through the compiler's debug information (DWARF2/DWARF3 format for ELF binaries), if you use GCC with the -g3 option. You can use GDB to extract the information, it parses the dwarf information to associate assembly code lines with source code lines, and memory locations to variable.
You have to know that a variable name is only an abstraction of a memory location which is only known to the compiler at compile time, and after optimizations. Keep in mind that if you push the compiler to optimize (-Ox with GCC, x = [1, 2, 3, s, fast]), it'll minimize its stack references and use registers instead. Therefore, all references to your local variables will vanish into a temporary use of registers (the registers will be released and used elsewhere).
Note : If you analyze an optimized code using GDB you'll notice that some function parameters or variables are shown as "optimized out".
Let me know if you need more details.
As far as I know it is possible only if the executable is compiled with debug information (DWARF). In other cases this information is removed. Here you can see an example of how it looks like.
