How to reuse symbol/data defined in .bss section?

Question

So basically I am trying to re-use some assembly code/data dumped by objdump from 32 bit ELF binary on Linux.

So basically, in the disassembled binary, I found some symbol referring to .bss section like this:

 80486b7:   mov    0x804b264,%eax   <- 0x804b264 is an addr in .bss
 80486bc:   movl   $0x0,0x4(%esp)
 80486c3:
 80486c4:   mov    %eax,(%esp)
 80486c7:   call   804876c <sum>

By digging into the original source code, I find out that 0x804b264 is used for stdin in .bss section.

IMHO, there are basically two situations on .bss section's data:

1. uninitialized data, will be uninitialized in the source code

2. some global/system related data (such as stdin in the above situation)

So when trying to re-use .bss section's data, I have tried this way:

.section .bss
S_0x804B260 : .byte 0x00
           .byte 0x00
           .byte 0x00
          .byte 0x00
S_0x804B264 : .byte 0x00          <- I lift addr into symbol!
          .byte 0x00
         .byte 0x00
         .byte 0x00
         .byte 0x00

and in the .text section, I will also lift corresponding addr into symbol.

same situation works fine for .rodata and .data section

But the problem is that, there are some global variables (such as stdin stdout), locating in .bss section, while are not initialized by user defined code, which means that in my re-used asm code, this symbol variable will always be zero!

I tried to manually substitute symbols corresponding to stdin, and it seems that it works fine.

But the problem is that:

1. How can I identify which symbol in the .bss section is some variables that initialized by system? such as stdin, stdout* and others?

2. If it is not possible, then is there anyway that I can enforce system to use memory in the .bss section where I want it to use?

Am I clear? Could anyone give me some help?

Answer 1

I'm afraid you're not too clear when you talk about "reusing" some part of a program. What exactly do you want to do? Load the original program into a debugger, then call just one single function of it? Extract a ranged of addresses and turn that into a new program? Or extract one function from the original program, possibly together with everything the function depends on, then embed that function into a larger program?

You're wrong in one thing: the .bss section is NOT initialized at all at program start (at least not to anything but a load of \0 bytes). The initialization of stuff like stdout is done in runtime before main() starts. Stuff that gets initialized with constant data goes into the .data segment.

(On a side note: One of the reasons why the stdout FILE structure isn't put into .data and initialized as constants is most runtimes on unix-like systems will check if their file descriptor goes to a terminal or something else, and turn on/off buffering depending on that check).

When you extract a part of the code, you'll have to check each reference to .data AND .bss (and to .text - the code - as well if the extracted part depends on any libraries etc.). For each of those references, you'll have to decide what to do with them - share them with the new program, keep them for the functions you extracted, whatever.

If you're lucky, and have an unstripped executable, you can use nm to find out which symbol is where; if you're not that lucky, you'll have to disassemble/decompile everything, understand it, rewrite it into new source, and compile it together with whatever you want to embed it in.