请问strip命令到底对可执行文件干了什么？

pluskid · 发表于 2006-1-13 14:08:42

strip
用法：strip <选项> 输入文件
从文件中删除符号和节

那么，删除符号和节之后对程序有什么影响呢（文件变小了，但是好像还是可以正确运行）。符号和节是什么东西呀？

herberteuler · 发表于 2006-1-13 14:30:13

一起讨论一下吧，呵呵。我是用 a.out 格式来理解的。

下面是 UNIX 中 a.out 格式文件的布局：

/* Layout of a.out file :
*
* header of 8 words magic number 405, 407, 410, 411
* text size )
* data size ) in bytes but even
* bss size )
* symbol table size
* entry point
* {unused}
* flag set if no relocation
*
*
* header: 0
* text: 16
* data: 16+textsize
* relocation: 16+textsize+datasize
* symbol table: 16+2*(textsize+datasize) or 16+textsize+datasize
*
*/

复制代码

下面是 a.out.h：

struct exec { /* a.out header */
int a_magic; /* magic number */
unsigned a_text; /* size of text segment */
unsigned a_data; /* size of initialized data */
unsigned a_bss; /* size of unitialized data */
unsigned a_syms; /* size of symbol table */
unsigned a_entry; /* entry point */
unsigned a_unused; /* not used */
unsigned a_flag; /* relocation info stripped */
};
#define A_MAGIC1 0407 /* normal */
#define A_MAGIC2 0410 /* read-only text */
#define A_MAGIC3 0411 /* separated I&D */
#define A_MAGIC4 0405 /* overlay */
struct nlist { /* symbol table entry */
char n_name[8]; /* symbol name */
int n_type; /* type flag */
unsigned n_value; /* value */
};
/* values for type flag */
#define N_UNDF 0 /* undefined */
#define N_ABS 01 /* absolute */
#define N_TEXT 02 /* text symbol */
#define N_DATA 03 /* data symbol */
#define N_BSS 04 /* bss symbol */
#define N_TYPE 037
#define N_REG 024 /* register name */
#define N_FN 037 /* file name symbol */
#define N_EXT 040 /* external bit, or'ed in */
#define FORMAT "%06o" /* to print a value */

复制代码

这是一个早期的 strip：

#include <a.out.h>
#include <signal.h>
char *tname;
char *mktemp();
struct exec head;
int a_magic[] = {A_MAGIC1, A_MAGIC2, A_MAGIC3, A_MAGIC4, 0};
int status;
int tf;
main(argc, argv)
char *argv[];
{
register i;
signal(SIGHUP, SIG_IGN);
signal(SIGINT, SIG_IGN);
signal(SIGQUIT, SIG_IGN);
tname = mktemp("/tmp/sXXXXX");
close(creat(tname, 0600));
tf = open(tname, 2);
if(tf < 0) {
printf("cannot create temp file\n");
exit(2);
}
for(i=1; i<argc; i++) {
strip(argv[i]);
if(status > 1)
break;
}
close(tf);
unlink(tname);
exit(status);
}
strip(name)
char *name;
{
register f;
long size;
int i;
f = open(name, 0);
if(f < 0) {
printf("cannot open %s\n", name);
status = 1;
goto out;
}
read(f, (char *)&head, sizeof(head));
for(i=0;a_magic[i];i++)
if(a_magic[i] == head.a_magic) break;
if(a_magic[i] == 0) {
printf("%s not in a.out format\n", name);
status = 1;
goto out;
}
if(head.a_syms == 0 && (head.a_flag&1) != 0) {
printf("%s already stripped\n", name);
goto out;
}
size = (long)head.a_text + head.a_data;
head.a_syms = 0;
head.a_flag |= 1;
lseek(tf, (long)0, 0);
write(tf, (char *)&head, sizeof(head));
if(copy(name, f, tf, size)) {
status = 1;
goto out;
}
size += sizeof(head);
close(f);
f = creat(name, 0666);
if(f < 0) {
printf("%s cannot recreate\n", name);
status = 1;
goto out;
}
lseek(tf, (long)0, 0);
if(copy(name, tf, f, size))
status = 2;
out:
close(f);
}
copy(name, fr, to, size)
char *name;
long size;
{
register s, n;
char buf[512];
while(size != 0) {
s = 512;
if(size < 512)
s = size;
n = read(fr, buf, s);
if(n != s) {
printf("%s unexpected eof\n", name);
return(1);
}
n = write(to, buf, s);
if(n != s) {
printf("%s unexpected write eof\n", name);
return(1);
}
size -= s;
}
return(0);
}

复制代码

这就是 strip 的作用。

hellwolf · 发表于 2006-1-13 14:36:34

给个直观的吧，更详细的不是论坛可以说清楚的，你需要了解更多的ELF的东西。

$cp /lib/libc.so.6 .
$nm libc.so.6 | head
0024ea90 T a64l
00329fe0 r a64l_table
00242790 T abort
0033fce0 b abortfunc
00243e08 T abs
002e4460 W accept
002d4ba0 W access
002d4ba0 t __access
002dc3e0 T acct
002305d0 t add_alias
$strip libc.so.6
$nm libc.so.6
nm: libc.so.6: no symbols

复制代码

这些symbol有什么用呢？用gdb调试跟踪的时候你就会知道了。

hellwolf · 发表于 2006-1-13 14:39:45

P.S:不赞成上面的用a.out格式来理解的方式，
ELF比a.out复杂多了。而且现在distro的内核不加入a.out的支持的，比如fedora的内核：
$cat /boot/config-2.6.14-1.1637_FC4 | grep AOUT
# CONFIG_BINFMT_AOUT is not set

还有
gcc产生的a.out文件和那个a.out格式只有历史关系，没有技术上的关联。

herberteuler · 发表于 2006-1-13 14:51:42

NAME
a.out – assembler and link editor output
SYNOPSIS
#include <a.out.h>
DESCRIPTION
A.out is the output file of the assembler as(1) and the link editor
ld(1). Both programs make a.out executable if there were no errors and
no unresolved external references. Layout information as given in the
include file for the PDP11 is:
struct exec { /* a.out header */
short a_magic; /* magic number */
unsigned a_text; /* size of text segment */
unsigned a_data; /* size of initialized data */
unsigned a_bss; /* size of uninitialized data */
unsigned a_syms; /* size of symbol table */
unsigned a_entry; /* entry point */
unsigned a_unused; /* not used */
unsigned a_flag; /* relocation info stripped */
};
#define A_MAGIC1 0407 /* normal */
#define A_MAGIC2 0410 /* read-only text */
#define A_MAGIC3 0411 /* separated I&D */
#define A_MAGIC4 0405 /* overlay */
struct nlist { /* symbol table entry */
char n_name[8]; /* symbol name */
int n_type; /* type flag */
unsigned n_value; /* value */
};
/* values for type flag */
#define N_UNDF 0 /* undefined */
#define N_ABS 01 /* absolute */
#define N_TEXT 02 /* text symbol */
#define N_DATA 03 /* data symbol */
#define N_BSS 04 /* bss symbol */
#define N_TYPE 037
#define N_REG 024 /* register name */
#define N_FN 037 /* file name symbol */
#define N_EXT 040 /* external bit, or’ed in */
#define FORMAT "%.6o" /* to print a value */
The file has four sections: a header, the program and data text,
relocation information, and a symbol table (in that order). The last
two may be empty if the program was loaded with the ‘– s’ option of ld
or if the symbols and relocation have been removed by strip(1).
In the header the sizes of each section are given in bytes, but are
even. The size of the header is not included in any of the other
sizes.
When an a.out file is loaded into core for execution, three logical
segments are set up: the text segment, the data segment (with
uninitialized data, which starts off as all 0, following initialized),
and a stack. The text segment begins at 0 in the core image; the
header is not loaded. If the magic number in the header is 0407(8), it
indicates that the text segment is not to be write-protected and
shared, so the data segment is immediately contiguous with the text
segment. If the magic number is 0410, the data segment begins at the
first 0 mod 8K byte boundary following the text segment, and the text
segment is not writable by the program; if other processes are
executing the same file, they will share the text segment. If the
magic number is 411, the text segment is again pure, write-protected,
and shared, and moreover instruction and data space are separated; the
text and data segment both begin at location 0. If the magic number is
0405, the text segment is overlaid on an existing (0411 or 0405) text
segment and the existing data segment is preserved.
The stack will occupy the highest possible locations in the core
image: from 0177776(8) and growing downwards. The stack is
automatically extended as required. The data segment is only extended
as requested by brk(2).
The start of the text segment in the file is 020(8); the start of the
data segment is 020+St (the size of the text) the start of the
relocation information is 020+St+Sd; the start of the symbol table is
020+2(St+Sd) if the relocation information is present, 020+St+Sd if
not.
The layout of a symbol table entry and the principal flag values that
distinguish symbol types are given in the include file. Other flag
values may occur if an assembly language program defines machine
instructions.
If a symbol’s type is undefined external, and the value field is
non-zero, the symbol is interpreted by the loader ld as the name of a
common region whose size is indicated by the value of the symbol.
The value of a word in the text or data portions which is not a
reference to an undefined external symbol is exactly that value which
will appear in core when the file is executed. If a word in the text
or data portion involves a reference to an undefined external symbol,
as indicated by the relocation information for that word, then the
value of the word as stored in the file is an offset from the
associated external symbol. When the file is processed by the link
editor and the external symbol becomes defined, the value of the
symbol will be added into the word in the file.
If relocation information is present, it amounts to one word per word
of program text or initialized data. There is no relocation
information if the ‘relocation info stripped’ flag in the header is
on.
Bits 3-1 of a relocation word indicate the segment referred to by the
text or data word associated with the relocation word:
000 absolute number
002 reference to text segment
004 reference to initialized data
006 reference to uninitialized data (bss)
010 reference to undefined external symbol
Bit 0 of the relocation word indicates, if 1, that the reference is
relative to the pc (e.g. ‘clr x’); if 0, that the reference is to the
actual symbol (e.g., ‘clr *$x’).
The remainder of the relocation word (bits 15-4) contains a symbol
number in the case of external references, and is unused
otherwise. The first symbol is numbered 0, the second 1, etc.
SEE ALSO
as(1), ld(1), nm(1)

复制代码

herberteuler · 发表于 2006-1-13 14:52:44

我倒是觉得利用这些“老东西”来快速地理解原理是一种非常有效的方式

因为一个人阅读 gcc 和 binutils 的全部源代码几乎是不可能的，而早期的 cc、as、ld 这些程序的源代码是可以一个人读完的，并且尽管格式复杂了，原理还是一样的。
就好像相对论力学比牛顿力学复杂多了，从牛顿力学开始理解力学仍可认为是一个好的方式。

hellwolf · 发表于 2006-1-13 15:44:41

Post by herberteuler
我倒是觉得利用这些“老东西”来快速地理解原理是一种非常有效的方式
因为一个人阅读 gcc 和 binutils 的全部源代码几乎是不可能的，而早期的 cc、as、ld 这些程序的源代码是可以一个人读完的，并且尽管格式复杂了，原理还是一样的。
就好像相对论力学比牛顿力学复杂多了，从牛顿力学开始理解力学仍可认为是一个好的方式。

我倒是认为关于ELF的资料要比a.out的好找的多而且更为“实用"，毕竟机器上都是ELF的东西，实验起来也方便。

herberteuler · 发表于 2006-1-13 16:09:18

Post by hellwolf
我倒是认为关于ELF的资料要比a.out的好找的多而且更为“实用"，毕竟机器上都是ELF的东西，实验起来也方便。

呵呵，我手头有全套的早期 UNIX 的资料，从硬件手册，到操作系统，到编译器、汇编器、链接器。它们没有别的特点，就是小，小到可以在很短的时间内完全理解。

另一方面，有专门的模拟器可以作为实验工具。

pluskid · 发表于 2006-1-13 17:55:06

哦！就是说，那写Symbol就是主要是用来给GDB调试用的？

恩，还有一个问题就是，herberteuler给的那段代码中，创建文件的时候，用了0666，这是文件的权限吧？如果a.out创建为0666的话不是就不具有可执行权限了？

哦！时间不早了！先去考试了。
6：30的Linux操作系统，全校公选课，现在的中国，真是无语了，我看了课程的习题，其中最有印象的一道题就是：
用ls命令得到的结果中，可执行文件是用什么颜色显示的？

晕~~~~

lucifer · 发表于 2006-1-13 18:06:18

Post by herberteuler
我倒是觉得利用这些“老东西”来快速地理解原理是一种非常有效的方式
因为一个人阅读 gcc 和 binutils 的全部源代码几乎是不可能的，而早期的 cc、as、ld 这些程序的源代码是可以一个人读完的，并且尽管格式复杂了，原理还是一样的。
就好像相对论力学比牛顿力学复杂多了，从牛顿力学开始理解力学仍可认为是一个好的方式。

相对论只是数学上复杂一些，概念绝对比牛顿简单多了
难道不是越接近真实的东西越简单才合理吗？

		自动登录	找回密码
密码			注册