1

I have two binary files, one of them is pulled from Protostar's (stack0 example). The other one I compiled (from source) with the latest version of GCC. The size difference is massive. My version is 11.5 Kb. The Protostar distributed version is 21.9 Kb. How would I get a high level overview to work towards an understanding of the massive difference in sizes?

I am compiling my version with 

CFLAGS=-m32 -fno-stack-protector -std=c89 -fno-PIE -no-pie -mpreferred-stack-boundary=2 -fno-chkp-use-wrappers -D_FORTIFY_SOURCE=0 -fno-check-pointer-bounds -z execstack -z norelro -Os
  • When I use Radare's show info with i everything is the same, except for the sizes.
  • The main functions are both very similar.

I'm just wondering what caused the original to be so much bigger. Is there an option or tool for something like radiff2 that can help me drill down to explain what my compiler is now doing differently than the compiler it was compiled with?

Improve this question
5
  • What is protostar and how are the two files related?
    – Igor Skochinsky ♦
    Commented Nov 9, 2018 at 20:45
  • They're both supposed to be compiled from the same source, but potentially a different set of compiler options or different compiler altogether (I just wanted to generate a similar main so I played with gcc until I got something good. But, I want to understand what else changed.
    – Evan Carroll
    Commented Nov 9, 2018 at 20:49
  • @IgorSkochinsky see my answer, be curious to know what you think of that and if that's a good place to start to figure out this?
    – Evan Carroll
    Commented Nov 9, 2018 at 22:26
  • "except for the sizes."... so which sizes are different and how?
    – Igor Skochinsky ♦
    Commented Nov 10, 2018 at 13:05
  • What does file give you on the two binaries? Perhaps one is stripped and the other isn't? Also one could be statically linked and perhaps not against glibc at all (for example musl-libc comes to mind as libc which is standards-compliant and yields small binaries)
    – 0xC0000022L ♦
    Commented Dec 10, 2018 at 8:45

2 Answers 2

Reset to default
2

Bloaty McBloatFace is a compiled binary size profiler that can provide a breakdown of section sizes as you have there as well as a number of other ways to break things out.

Improve this answer
1

I'm not going to accept this answer, because likely someone else will tell me a better way to do it. But, browsing the site I saw an old picture of Radare that seemed to kind of do what I want with an S= option. This is showing the breakdown by section. That seemed like a good place to start.

enter image description here

Turns out that's now really close to the undocumented iS= option.

Using that on both binaries, I saw the difference really quick,

[0x00000000]> iS=
00  0x00000000 |--------------------------------------------------------------------------------------------------| 0x00000000     0 ---      
01  0x08048114 |-#------------------------------------------------------------------------------------------------| 0x08048127    19 r--  .interp
02  0x08048128 |-#------------------------------------------------------------------------------------------------| 0x08048148    32 r--  .note.ABI_tag
03  0x08048148 |-#------------------------------------------------------------------------------------------------| 0x0804816c    36 r--  .note.gnu.build_id
04  0x0804816c |-#------------------------------------------------------------------------------------------------| 0x08048198    44 r--  .hash
05  0x08048198 |-#------------------------------------------------------------------------------------------------| 0x080481b8    32 r--  .gnu.hash
06  0x080481b8 |-##-----------------------------------------------------------------------------------------------| 0x08048218    96 r--  .dynsym
07  0x08048218 |--#-----------------------------------------------------------------------------------------------| 0x08048267    79 r--  .dynstr
08  0x08048268 |--#-----------------------------------------------------------------------------------------------| 0x08048274    12 r--  .gnu.version
09  0x08048274 |--#-----------------------------------------------------------------------------------------------| 0x08048294    32 r--  .gnu.version_r
10  0x08048294 |--#-----------------------------------------------------------------------------------------------| 0x0804829c     8 r--  .rel.dyn
11  0x0804829c |--##----------------------------------------------------------------------------------------------| 0x080482bc    32 r--  .rel.plt
12  0x080482bc |---#----------------------------------------------------------------------------------------------| 0x080482ec    48 r-x  .init
13  0x080482ec |---#----------------------------------------------------------------------------------------------| 0x0804833c    80 r-x  .plt
14  0x08048340 |---###--------------------------------------------------------------------------------------------| 0x080484dc   412 r-x  .text
15  0x080484dc |-----#--------------------------------------------------------------------------------------------| 0x080484f8    28 r-x  .fini
16  0x080484f8 |-----#--------------------------------------------------------------------------------------------| 0x08048534    60 r--  .rodata
17  0x08048534 |-----#--------------------------------------------------------------------------------------------| 0x08048538     4 r--  .eh_frame
18  0x08049538 |-----#--------------------------------------------------------------------------------------------| 0x08049540     8 rw-  .ctors
19  0x08049540 |-----#--------------------------------------------------------------------------------------------| 0x08049548     8 rw-  .dtors
20  0x08049548 |-----#--------------------------------------------------------------------------------------------| 0x0804954c     4 rw-  .jcr
21  0x0804954c |-----##-------------------------------------------------------------------------------------------| 0x0804961c   208 rw-  .dynamic
22  0x0804961c |------#-------------------------------------------------------------------------------------------| 0x08049620     4 rw-  .got
23  0x08049620 |------#-------------------------------------------------------------------------------------------| 0x0804963c    28 rw-  .got.plt
24  0x0804963c |-------#------------------------------------------------------------------------------------------| 0x08049644     8 rw-  .data
25  0x08049644 |-------#------------------------------------------------------------------------------------------| 0x0804964c     0 rw-  .bss
26* 0x00000000 |-------############-------------------------------------------------------------------------------| 0x00000a68  2.6K ---  .stab
27* 0x00000000 |------------------###################################################################-------------| 0x00003a5c 14.6K ---  .stabstr
28* 0x00000000 |------------------------------------------------------------------------------------#-------------| 0x00000039    57 ---  .comment
29* 0x00000000 |------------------------------------------------------------------------------------##------------| 0x000000fd   253 ---  .shstrtab
30* 0x00000000 |-------------------------------------------------------------------------------------------#####--| 0x00000440    1K ---  .symtab
31* 0x00000000 |------------------------------------------------------------------------------------------------##| 0x0000020c   524 ---  .strtab
32  0x08048034 |##------------------------------------------------------------------------------------------------| 0x08048114   224 r-x  PHDR
33  0x08048114 |-#------------------------------------------------------------------------------------------------| 0x08048127    19 r--  INTERP
34  0x08048000 |######--------------------------------------------------------------------------------------------| 0x08048538  1.3K r-x  LOAD0
35  0x08049538 |-----###------------------------------------------------------------------------------------------| 0x0804964c   268 rw-  LOAD1
36  0x0804954c |-----##-------------------------------------------------------------------------------------------| 0x0804961c   208 rw-  DYNAMIC
37  0x08048128 |-#------------------------------------------------------------------------------------------------| 0x0804816c    68 r--  NOTE
38  0x00000000 |--------------------------------------------------------------------------------------------------| 0x00000000     0 rwx  GNU_STACK
39  0x08048000 |#-------------------------------------------------------------------------------------------------| 0x08048034    52 rw-  ehdr
=>  0x00000000 |^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^| 0xffffffffffffffff

That .stabstr thing was huge. I found this on Stack Overflow,

I'd be surprised if the debugging format was stabs on either platform unless you had explicitly requested it with -gstabs as an argument to gcc.

I enabled that option and suddenly my new binary had one too, and it was pretty close in size to the old one.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.