On Tue, 2011-05-10 at 14:27 +0200, Samuel Thibault wrote:
> Svante Signell, le Tue 10 May 2011 14:23:13 +0200, a écrit :
> > On Tue, 2011-05-10 at 14:06 +0200, Samuel Thibault wrote:
> > ...
> > > > Well objdump gave a lot of hits for mach_port_deallocate but
> > > > mach_port_deallocate_debug was not found. And the addresses are
> > > > different from the hex editor. Anyway using objdump -D I found it:
> > > >
> > > > 002c10c0 <mach_port_deallocate_debug>:
> > > > 2c10c0: 00 00 add %al,(%eax)
> > >
> > > But that's not a file offset. Actually I meant objdump -x, to get the
> > > headers, which tell you know virtual addresses relate with file offsets.
> >
> > OK I found it:
> > SYMBOL TABLE:
> > ...
> > 002c10c0 l O .bss 00000004 mach_port_deallocate_debug
> >
> > Is the file offset 4 byte?
>
> No, it's the size. What's interesting is the header of the output, which
> describes the file offset of each section
gnumach-1.3.99-486-dbg: file format elf32-i386
gnumach-1.3.99-486-dbg
architecture: i386, flags 0x00000112:
EXEC_P, HAS_SYMS, D_PAGED
start address 0x00100000
Program Header:
LOAD off 0x00001000 vaddr 0x00100000 paddr 0x00100000 align 2**12
filesz 0x001ab13c memsz 0x001ab13c flags r-x
LOAD off 0x001ac140 vaddr 0x002ac140 paddr 0x002ac140 align 2**12
filesz 0x00010bcc memsz 0x0003c0a0 flags rw-
STACK off 0x00000000 vaddr 0x00000000 paddr 0x00000000 align 2**2
filesz 0x00000000 memsz 0x00000000 flags rwx
> > How to change the hex line:
> > 002c10c0: 2318 0614 1600 000a etc.
>
> It's not there.
Where is it then?
