forestaa / troll

dwarf debug information analyzer

Troll

Troll is an analyzer of the DWARF information embeded in ELF binary. This is inspired by fromelf, and written in Rust.

Features

• Output static variable information

Install

• Downloads binaries from Release

Examples

$ git clone https://github.com/forestaa/troll.git
$ cat examples/simple.c
#include <stdio.h>

typedef struct hoge {
  int hoge;
  char hogehoge;
  int array[2];
} Hoge;

Hoge hoges[3];

int main(void) {
  return 0;
}
$ gcc -O0 -g -o examples/simple examples/simple.c
$ cargo run examples/simple  # You can run `./troll examples/simple` if you install a binary.
...

address    size  variable_name        type
0x00004060 0x030 hoges                Hoge[2]
0x00004060 0x010 hoges[0]             Hoge
0x00004060 0x004 hoges[0].hoge        int
0x00004064 0x001 hoges[0].hogehoge    char
0x00004068 0x008 hoges[0].array       int[1]
0x00004068 0x004 hoges[0].array[0]    int
0x0000406c 0x004 hoges[0].array[1]    int
0x00004070 0x010 hoges[1]             Hoge
0x00004070 0x004 hoges[1].hoge        int
0x00004074 0x001 hoges[1].hogehoge    char
0x00004078 0x008 hoges[1].array       int[1]
0x00004078 0x004 hoges[1].array[0]    int
0x0000407c 0x004 hoges[1].array[1]    int
0x00004080 0x010 hoges[2]             Hoge
0x00004080 0x004 hoges[2].hoge        int
0x00004084 0x001 hoges[2].hogehoge    char
0x00004088 0x008 hoges[2].array       int[1]
0x00004088 0x004 hoges[2].array[0]    int
0x0000408c 0x004 hoges[2].array[1]    int

troll's Issues

struct and union can be anonymous

function pointer is not supported yet

volatile is not supported

Logging

Release

Exit when encountering unknown type

Just warn and proceed.

char variable is not aligned and upper_bound of an array is interpreted differently

A char variable in a structure should be aligned.
The type has size 1, but the variable can have size 4.

Moreover, the variable should have 3 children when the upper_bound of an array is 2.
Currently, it has 3 children.

The output of eu-readlef is below.
The byte_size is 16 and data_member_location is aligned even though the member has the type char.

 [    2d]    structure_type       abbrev: 2
             name                 (strp) "hoge"
             byte_size            (data1) 16
             decl_file            (data1) simple.c (1)
             decl_line            (data1) 1
             decl_column          (data1) 16
             sibling              (ref4) [    62]
 [    3a]      member               abbrev: 3
               name                 (strp) "hoge"
               decl_file            (data1) simple.c (1)
               decl_line            (data1) 2
               decl_column          (data1) 7
               type                 (ref4) [    62]
               data_member_location (data1) 0
 [    47]      member               abbrev: 3
               name                 (strp) "hogehoge"
               decl_file            (data1) simple.c (1)
               decl_line            (data1) 3
               decl_column          (data1) 8
               type                 (ref4) [    69]
               data_member_location (data1) 4
 [    54]      member               abbrev: 3
               name                 (strp) "array"
               decl_file            (data1) simple.c (1)
               decl_line            (data1) 4
               decl_column          (data1) 7
               type                 (ref4) [    70]
               data_member_location (data1) 8

Current output is below.
The size is different and char variable is not aligned.

address    size  variable_name        type
0x00004060 0x012 hoges                Hoge[2]
0x00004060 0x009 hoges[0]             Hoge
0x00004060 0x004 hoges[0].hoge        int
0x00004064 0x001 hoges[0].hogehoge    char
0x00004065 0x004 hoges[0].array       int[1]
0x00004065 0x004 hoges[0].array[0]    int
0x00004069 0x009 hoges[1]             Hoge
0x00004069 0x004 hoges[1].hoge        int
0x0000406d 0x001 hoges[1].hogehoge    char
0x0000406e 0x004 hoges[1].array       int[1]
0x0000406e 0x004 hoges[1].array[0]    int

CI

• test
• release

maybe use Github Actions?

extern is not supported yet

base_type entry might not have byte_size

base_type entry might not have byte_size attribute, but current implementation requires base_type entry to have byte_size.

enum is not supported yet

Output enum with its tags and values.

Exit when variable has location which is not exprloc

What

Global variables have the location which is exprloc, but local variables might not have the location.
Currently, the program exit when encountering such a variable.

Error handling

Currently does not provide an appropriate error message.
Define custom error and provide messages.

README

enum value is not printed when typedef enum

Assume the input is like this:

typedef enum {
A,
B,
} AB;
AB ab;

The output is as follows:

address    size  variable_name        type
0x0000402c 0x004 ab                   AB

But, it is desired to print the enum value A = 0, B = 1.

Possibility of the existence of global variables whose depth is not one

union is not supported yet

1. Support union only byte_size and warn if not present
2. Support bit_size

subroutine_type doesn't have type attribute when the function returns void

void (*callback)(void);

int main() {
  return 0;
}

then

 [    2d]    subroutine_type      abbrev: 2
             prototyped           (flag_present) yes

No formal parameter.

bit_size is not supported yet

1. Print warning message and go next.
2. Support.

Support only first compilation unit

Test