structhd_ftr {//harddisk_footer char cookie[8]; /* Identifies original creator of the disk *///魔数 u32 features; /* Feature Support -- see below */ u32 ff_version; /* (major,minor) version of disk file */ u64 data_offset; /* Abs. offset from SOF to next structure */ u32 timestamp; /* Creation time. secs since 1/1/2000GMT */ char crtr_app[4]; /* Creator application */ u32 crtr_ver; /* Creator version (major,minor) */ u32 crtr_os; /* Creator host OS */ u64 orig_size; /* Size at creation (bytes) */ u64 curr_size; /* Current size of disk (bytes) */ u32 geometry; /* Disk geometry */ u32 type; /* Disk type */ u32 checksum; /* 1's comp sum of this struct. */ vhd_uuid_t uuid; /* Unique disk ID, used for naming parents */ char saved; /* one-bit -- is this disk/VM in a saved state? */ char hidden; /* tapdisk-specific field: is this vdi hidden? */ char reserved[426]; /* padding */ };
cookie
可以理解为文件魔数,通过检查cookie值是否是"conectix",判断该VHD是否有效
conectix是connectix公司的名称缩写,这个技术是connectix发明的
features
1 2 3
#define HD_NO_FEATURES 0x00000000 #define HD_TEMPORARY 0x00000001 /* disk can be deleted on shutdown *///只要关机就删除硬盘 #define HD_RESERVED 0x00000002 /* NOTE: must always be set */
case IDM_APP_ABOUT: if (DialogBox (hInstance, TEXT ("AboutBox"), hwnd, AboutDlgProc))//如果DialogBox返回值1说明确实有修改,需要重绘,否则不需要重绘 InvalidateRect (hwnd, NULL, TRUE) ;
switch (message) { case WM_COMMAND: hMenu = GetMenu(hwnd);
switch (LOWORD(wParam)) { case IDM_FILE_NEW: case IDM_FILE_OPEN: case IDM_FILE_SAVE: case IDM_FILE_SAVE_AS:
MessageBeep(0);//蜂鸣 return0; case IDM_APP_EXIT: SendMessage(hwnd, WM_CLOSE, 0, 0);//发送程序退出关闭消息 return0;
case IDM_EDIT_UNDO: case IDM_EDIT_CUT: case IDM_EDIT_COPY: case IDM_EDIT_PASTE: case IDM_EDIT_CLEAR: MessageBeep(0); return0;
case IDM_BKGND_WHITE: // Note: Logic below //各种颜色背景是互斥关系,只能使用一个 case IDM_BKGND_LTGRAY: // assumes that IDM_WHITE case IDM_BKGND_GRAY: // through IDM_BLACK are case IDM_BKGND_DKGRAY: // consecutive numbers in case IDM_BKGND_BLACK: // the order shown here.
BOOL WINAPI DllMain( HINSTANCE hinstDLL, // handle to DLL module DWORD fdwReason, // reason for calling function LPVOID lpReserved )// reserved { // Perform actions based on the reason for calling. switch( fdwReason ) { case DLL_PROCESS_ATTACH: // Initialize once for each new process. // Return FALSE to fail DLL load. break;
case DLL_THREAD_ATTACH: // Do thread-specific initialization. break;
case DLL_THREAD_DETACH: // Do thread-specific cleanup. break;
case DLL_PROCESS_DETACH: // Perform any necessary cleanup. break; } return TRUE; // Successful DLL_PROCESS_ATTACH. }
structSYMBOL_DESCRIPTOR // size =0x14 { WORD a; WORD b; WORD c; WORD Architecture;//程序可以运行的体系结构,比如x86,x86_64 DWORD Id;//随机生成的ID DWORD Length;//符号名和库名 字符串总长度 union { WORD Hint;//最有可能的序号 WORD Ordinal; WORD Value; } WORD Type; };
PS C:\Users\86135\desktop\testDLL> link TestMath.obj Math.dll Microsoft (R) Incremental Linker Version 14.31.31106.2 Copyright (C) Microsoft Corporation. All rights reserved.
HINSTANCE hinstLib=LoadLibrary(DllName); if(hinstLib==NULL){ printf("ERROR: loading failed\n"); returnNULL; } Func function =(Func)GetProcAddress(hinstLib,FuncName); if(!function){ printf("no such function in this module\n"); FreeLibrary(hinstLib); returnNULL; } return function; }
SECTION HEADER #1 .drectve name 0 physical address 0 virtual address 53 size of raw data B4 file pointer to raw data (000000B4 to 00000106) 0 file pointer to relocation table 0 file pointer to line numbers 0 number of relocations 0 number of line numbers 100A00 flags Info Remove 1 byte align
.edata:000000000000004F $N00001 db 'Add',0 ; DATA XREF: .edata:rgszName↑o .edata:0000000000000053 $N00002 db 'Mul',0 ; DATA XREF: .edata:0000000000000038↑o .edata:0000000000000057 $N00003 db 'Sub',0 ; DATA XREF: .edata:000000000000003C↑o
PS C:\Users\86135\desktop\Math> dumpbin /IMPORTS Math.dll Microsoft(R) COFF/PE Dumper Version 14.31.31106.2 Copyright(C) Microsoft Corporation. All rights reserved.
Dump of file Math.dll
File Type: DLL
Section contains the following imports:
KERNEL32.dll 18000F000 Import Address Table 180017E68 Import Name Table 0 time date stamp 0 Index of first forwarder reference
C:\Users\86135\Desktop\math>dumpbin TestMath.exe /IMPORTS Microsoft (R) COFF/PE Dumper Version 14.31.31106.2 Copyright (C) Microsoft Corporation. All rights reserved.
Dump of file TestMath.exe
File Type: EXECUTABLE IMAGE
Section contains the following imports:
MATH.dll 414110 Import Address Table 41A640 Import Name Table 0 time date stamp 0 Index of first forwarder reference
2 Sub
KERNEL32.dll 414000 Import Address Table 41A530 Import Name Table 0 time date stamp 0 Index of first forwarder reference
C:\Users\86135\Desktop\math>dumpbin TestMath.exe /IMPORTS Microsoft(R) COFF/PE Dumper Version 14.31.31106.2 Copyright(C) Microsoft Corporation. All rights reserved.
Dump of file TestMath.exe
File Type: EXECUTABLE IMAGE
Section contains the following imports:
MATH.dll 414110 Import Address Table 41A640 Import Name Table FFFFFFFF time date stamp FFFFFFFF Index of first forwarder reference
10001020 2 Sub
KERNEL32.dll 414000 Import Address Table 41A530 Import Name Table FFFFFFFF time date stamp FFFFFFFF Index of first forwarder reference
PS C:\Users\86135\desktop\testDLL> dumpbin /EXPORTS Math.dll Microsoft (R) COFF/PE Dumper Version 14.31.31106.2 Copyright (C) Microsoft Corporation. All rights reserved.
Dump of file Math.dll
File Type: DLL
Section contains the following exports for Math.dll
00000000 characteristics FFFFFFFF time date stamp 0.00 version 1 ordinal base 3 number of functions 3 number of names
PS C:\Users\86135\desktop\Math> dumpbin /IMPORTS Math.dll Microsoft(R) COFF/PE Dumper Version 14.31.31106.2 Copyright(C) Microsoft Corporation. All rights reserved.
Dump of file Math.dll
File Type: DLL
Section contains the following imports:
KERNEL32.dll 18000F000 Import Address Table 180017E68 Import Name Table 0 time date stamp 0 Index of first forwarder reference
PS C:\Users\86135\desktop\Math> dumpbin /IMPORTS TestMath.exe Microsoft(R) COFF/PE Dumper Version 14.31.31106.2 Copyright(C) Microsoft Corporation. All rights reserved.
Dump of file TestMath.exe
File Type: EXECUTABLE IMAGE
Section contains the following imports:
Math.dll 140016258 Import Address Table 140020060 Import Name Table 0 time date stamp 0 Index of first forwarder reference
2 Sub
KERNEL32.dll 140016000 Import Address Table 14001FE08 Import Name Table 0 time date stamp 0 Index of first forwarder reference
for (x = 0; x < DIVISIONS; x++) for (y = 0; y < DIVISIONS; y++) MoveWindow(hwndChild[x][y],//调整子窗口的位置和大小 x * cxBlock, y * cyBlock, cxBlock, cyBlock, TRUE);//大小是cxBlock宽,cyBlock高 return0;
MoveWindow
对于子窗口来说,该函数中指定的坐标都是相对于父窗口客户区左上角的
对于非子窗口来说,该函数中的坐标是屏幕坐标
1 2 3 4 5 6 7 8
BOOL MoveWindow( [in] HWND hWnd,//需要移动位置的窗口句柄,一般用于父窗口过程移动子窗口 [in] int X, [in] int Y, [in] int nWidth,//移动顺便设置尺寸 [in] int nHeight, [in] BOOL bRepaint//是否重绘,TRUE则hWnd指向的窗口收到WM_PAINT消息 );
case WM_KEYDOWN: x = idFocus & 0xFF;//x保存原来的焦点位置(子窗口下标) y = idFocus >> 8;//y保存原来的焦点位置 switch (wParam) { case VK_UP: y--;//焦点上移 break; case VK_DOWN: y++; break; case VK_LEFT: x--; break; case VK_RIGHT: x++; break; case VK_HOME: x = y = 0; break; case VK_END: x = y = DIVISIONS - 1; break; x = (x + DIVISIONS) % DIVISIONS; y = (y + DIVISIONS) % DIVISIONS; idFocus = y << 8 | x;//调整新焦点 SetFocus(GetDlgItem(hwnd, idFocus));//设置新焦点 return0;
这里计算x,y坐标的方式根HMENU参数的定义方式相反,互为逆运算
1 2 3 4 5
x = idFocus & 0xFF;//x保存原来的焦点位置 y = idFocus >> 8;//y保存原来的焦点位置 ... idFocus = y << 8 | x;//调整新焦点
WM_KEYDOWN消息执行完毕后立刻设置当前子窗口为焦点窗口
窗口销毁消息
1 2 3 4
case WM_DESTROY: PostQuitMessage(0); return0; }
子窗口过程ChildWndProc
子窗口创建消息
1 2 3
case WM_CREATE: SetWindowLong(hwnd, 0, 0); // on/off flag ,刚创建时本窗口的开关状态置0 return0;
修改窗口的一个属性
1 2 3 4 5
LONG SetWindowLongA( [in] HWND hWnd,//窗口句柄 [in] int nIndex,//指定要修改的窗口属性 [in] LONG dwNewLong//该窗口属性的新值 );
例子中修改的是下标为0的属性,对应的宏定义是DWL_MSGRESULT(0)
设置对话框过程的返回值,设置成了0.
实际上子窗口也不需要把这个值返回给父窗口看,它自己就可以决定把自己绘制成什么颜色
因此只是借用了一个线程的窗口属性来放置自己应该是按下还是起来的状态
子窗口键鼠消息
由于父窗口中会主动将焦点下放到子窗口,因此焦点子窗口可获取键鼠的输入.
父窗口只能等子窗口吃完了然后吃剩下的
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17
case WM_KEYDOWN: // Send most key presses to the parent window
if (wParam != VK_RETURN && wParam != VK_SPACE)//子窗口只负责拦截并处理空格回车消息,其他键盘消息丢给父窗口 { SendMessage(GetParent(hwnd), message, wParam, lParam);//其他键盘消息传递给父窗口 return0; } // For Return and Space, fall through to toggle the square //如果是空格和回车则相当于鼠标左键按下,一起处理 case WM_LBUTTONDOWN://左键单击按下 SetWindowLong(hwnd, 0, 1 ^ GetWindowLong(hwnd, 0));//子窗口开关状态置反 SetFocus(hwnd);//本子窗口获取焦点 InvalidateRect(hwnd, NULL, FALSE);//立刻重绘 return0; // For focus messages, invalidate the window for repaint
case WM_SETFOCUS: idFocus = GetWindowLong(hwnd, GWL_ID); // Fall through case WM_KILLFOCUS: InvalidateRect(hwnd, NULL, TRUE);//失效重绘,因为子窗口获得焦点的时候会有绘制方框提示,因此失去焦点时应当不再提示 return0;
GetWindowLong 获取窗口属性
由于窗口属性都是LONG类型的值,因此该函数取名"GetWindowLong"
1 2 3 4
LONG GetWindowLongA( [in] HWND hWnd,//指定要获取信息的窗口句柄 [in] int nIndex//指定要获取该窗口的哪个属性 );
Value
Meaning
GWL_EXSTYLE-20
获取窗口实例的拓展风格,即CreateWindow函数指定的dwExStyle
GWL_HINSTANCE-6
获取应用程序句柄
GWL_HWNDPARENT-8
获取父窗口句柄
GWL_ID-12
获取本窗口的索引值,即CreateWindow函数指定的HMENU值
GWL_STYLE-16
获取窗口实例的风格,这个风格就是CreateWindow指定的dwStyle
GWL_USERDATA-21
Retrieves the user data associated with
the window. This data is intended for use by the application that
created the window. Its value is initially zero.
GWL_WNDPROC-4
Retrieves the address of the window
procedure, or a handle representing the address of the window procedure.
You must use the CallWindowProc
function to call the window procedure.
The following values are also available when the hWnd
parameter identifies a dialog box.
Value
Meaning
DWL_DLGPROCDWLP_MSGRESULT
+ sizeof(LRESULT)
Retrieves the address of the dialog box
procedure, or a handle representing the address of the dialog box
procedure. You must use the CallWindowProc
function to call the dialog box procedure.
DWL_MSGRESULT0
Retrieves the return value of a message
processed in the dialog box procedure.
DWL_USERDWLP_DLGPROC +
sizeof(DLGPROC)
Retrieves extra information private to the
application, such as handles or pointers.
The SetROP2 function sets the current foreground mix
mode. GDI uses the foreground mix mode to combine pens and interiors of
filled objects with the colors already on the screen. The foreground mix
mode defines how colors from the brush or pen and the colors in the
existing image are to be combined.
//所有的键盘动作,包括击键消息和字符消息还有系统键消息都记录下来 case WM_KEYDOWN://键盘按下 case WM_KEYUP://键盘起来 case WM_CHAR://字符消息 case WM_DEADCHAR://死字符消息 case WM_SYSKEYDOWN://系统键Alt按下 case WM_SYSKEYUP://系统键起来 case WM_SYSCHAR://系统字符消息 case WM_SYSDEADCHAR://系统死字符消息 // Rearrange storage array for (i = cLinesMax - 1; i > 0; i--) { pmsg[i] = pmsg[i - 1];//新的键盘记录放到pmsg[0],历史消息都顺次后移一个 //如果消息总数超过了cLinesMax则丢弃早些时候到达的消息,实际上维护了一个队列 } // Store new message pmsg[0].hwnd = hwnd;//记录最新键盘消息 pmsg[0].message = message; pmsg[0].wParam = wParam; pmsg[0].lParam = lParam; cLines = min(cLines + 1, cLinesMax);//更新 "已使用行数" ,但是最大值不能超过最大行数 // Scroll up the display ScrollWindow(hwnd, 0, -cyChar, &rectScroll, &rectScroll);//滚动rectScroll对应区域,实际上整个网上平移cyChar即一行的高度 break; // i.e., call DefWindowProc so Sys messages work
"i.e., call DefWindowProc so Sys messages work"翻译成人话:
for (y = 0; y < cyBuffer; y++) for (x = 0; x < cxBuffer; x++) BUFFER(x, y) = ' ';//初始化buffer全为空格 // set caret to upper left corner xCaret = 0;//初始插入字符位置(0,0) yCaret = 0;
case WM_SETFOCUS: // create and show the caret CreateCaret(hwnd, NULL, cxChar, cyChar);//当前窗口获取焦点,此时创建插入字符 SetCaretPos(xCaret * cxChar, yCaret * cyChar);//设置好插入字符的位置,这个位置可以通过方向键等改变 ShowCaret(hwnd);//显示插入字符 return0;
失去焦点消息
1 2 3 4 5
case WM_KILLFOCUS: // hide and destroy the caret HideCaret(hwnd);//失去焦点,隐藏插入符号 DestroyCaret();//删除插入符号 return0;
typedefstruct_IMAGE_FILE_HEADER { WORD Machine; WORD NumberOfSections; DWORD TimeDateStamp; DWORD PointerToSymbolTable; DWORD NumberOfSymbols; WORD SizeOfOptionalHeader; WORD Characteristics; } IMAGE_FILE_HEADER,*PIMAGE_FILE_HEADER;
与PE文件有区别
在PE文件中映像文件头就是NT文件头,它是PE头的成员NT头的成员
而在COFF中上来就是镜像文件头
使用dumpbin观察main.obj文件的映像文件头
1 2 3 4 5 6 7 8 9 10 11 12
Dump of file main.obj
File Type: COFF OBJECT
FILE HEADER VALUES 8664 machine (x64) E number of sections 62F46FCA time date stamp Thu Aug 1110:56:102022 4E5 file pointer to symbol table 30 number of symbols 0 size of optional header 0 characteristics
SECTION HEADER #1 .drectve name 0 physical address 0 virtual address 18 size of raw data 244 file pointer to raw data (00000244 to 0000025B) 0 file pointer to relocation table 0 file pointer to line numbers 0 number of relocations 0 number of line numbers 100A00 flags Info #0x200,该段包含的是注释或者其他信息 Remove #0x800,链接成exe文件时该段最终被抛弃 1 byte align #0x100000,1字节对齐,相当于没有对齐要求
.debug
调试信息
.debug$S表示包含符号相关的调试信息段
.debug$P表示预编译头的调试信息段
.debug$T表示类型相关的调试信息段
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15
SECTION HEADER #2 .debug$S name 0 physical address 0 virtual address 74 size of raw data 11C file pointer to raw data (0000011C to 0000018F) 0 file pointer to relocation table 0 file pointer to line numbers 0 number of relocations 0 number of line numbers 42100040 flags Initialized Data Discardable 1 byte align Read Only
#include<stdio.h> int global_initialized=10; int global_uninitialized; staticint static_initialized=20; staticint static_uninitialized; intmain(){ int local; printf("%d,%d,%d,%d,%d",global_initialized,global_uninitialized,static_initialized,static_uninitialized,local); return0; }
typedefstruct { Elf32_Word st_name; /* Symbol name (string tbl index) */ Elf32_Addr st_value; /* Symbol value */ Elf32_Word st_size; /* Symbol size */ unsignedchar st_info; /* Symbol type and binding */ unsignedchar st_other; /* Symbol visibility */ Elf32_Section st_shndx; /* Section index */ } Elf32_Sym;
typedefstruct { Elf64_Word st_name; /* Symbol name (string tbl index) */ unsignedchar st_info; /* Symbol type and binding */ unsignedchar st_other; /* Symbol visibility */ Elf64_Section st_shndx; /* Section index */ Elf64_Addr st_value; /* Symbol value */ Elf64_Xword st_size; /* Symbol size */ } Elf64_Sym;
//低四位表示符号类型 /* Legal values for ST_BIND subfield of st_info (symbol binding). */
#define STB_LOCAL 0 /* Local symbol,局部符号 */ #define STB_GLOBAL 1 /* Global symbol,全局符号 */ #define STB_WEAK 2 /* Weak symbol,弱引用 */ #define STB_NUM 3 /* Number of defined types. 一共就三种符号,0,1,2*/ //STB_NUM表明一共就三种符号
//高四位表示符号绑定信息 /* Legal values for ST_TYPE subfield of st_info (symbol type). */
#define STT_NOTYPE 0 /* Symbol type is unspecified ,未知类型符号*/ #define STT_OBJECT 1 /* Symbol is a data object ,数据对象,数组,变量,对象*/ #define STT_FUNC 2 /* Symbol is a code object ,函数*/ #define STT_SECTION 3 /* Symbol associated with a section ,节*/ #define STT_FILE 4 /* Symbol's name is file name ,文件名*/ #define STT_COMMON 5 /* Symbol is a common data object */ #define STT_TLS 6 /* Symbol is thread-local data object*/ #define STT_NUM 7 /* Number of defined types. */ //STT_NUM表明一共就7种符号绑定信息
比如global_initialized这个符号,是一个全局的数据对象
image-20220806105817155
又比如test.c这个符号
image-20220806105930937
是一个局部文件名符号
st_other
预留的成员,目前没用
st_shndx
符号所在节的下标
比如main这个符号,不用想啃腚是在text节
image-20220806104544566
该值为1,去查节头表
image-20220806104627621
下标为1的节就是.text
对于不在本文件中定义的符号或者一些特殊符号,该值有特殊意义
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16
/* Special section indices. */
#define SHN_UNDEF 0 /* Undefined section ,本符号未在本文件定义,只在本文件中被引用,可能定义在其他文件中*/ #define SHN_LORESERVE 0xff00 /* Start of reserved indices */ #define SHN_LOPROC 0xff00 /* Start of processor-specific */ #define SHN_BEFORE 0xff00 /* Order section before all others (Solaris). */ #define SHN_AFTER 0xff01 /* Order section after all others (Solaris). */ #define SHN_HIPROC 0xff1f /* End of processor-specific */ #define SHN_LOOS 0xff20 /* Start of OS-specific */ #define SHN_HIOS 0xff3f /* End of OS-specific */ #define SHN_ABS 0xfff1 /* Associated symbol is absolute ,一个绝对的值*/ #define SHN_COMMON 0xfff2 /* Associated symbol is common ,该符号是一个COMMON伪节中的符号,未初始化的全局符号*/ #define SHN_XINDEX 0xffff /* Index is in extra table. */ #define SHN_HIRESERVE 0xffff /* End of reserved indices */
/* The following, at least, is used on Sparc v9, MIPS, and Alpha. */
typedefstruct { Elf64_Addr r_offset; /* Address */ Elf64_Xword r_info; /* Relocation type and symbol index */ } Elf64_Rel;
r_offset
需要修正的位置,相对于该符号所在节的偏移量
就是objdump -r之后的OFFSET栏目
r_info
重定位条目的类型和符号
工具
Linux ELF
gcc编译链接
只编译不链接
1
gcc -c main.c -o main.o
编译链接
1
gcc main.c -o main
file查看文件格式
lilnux上file的参数可以为任何文件,其作用是报告该文件的基本信息
1 2 3 4 5 6 7 8 9 10 11
┌──(root㉿Executor)-[/mnt/c/Users/86135/desktop/COFF] └─# file main.c main.c: C source, ASCII text, with CRLF line terminators
┌──(root㉿Executor)-[/mnt/c/Users/86135/desktop/COFF] └─# file main.exe main.exe: PE32+ executable (console) x86-64, for MS Windows
┌──(root㉿Executor)-[/mnt/c/Users/86135/desktop/COFF] └─# file main main: ELF 64-bit LSB pie executable, x86-64, version 1 (SYSV), dynamically linked, interpreter /lib64/ld-linux-x86-64.so.2, BuildID[sha1]=45f82af9109c5336fc17e25b88c4ce4def86b6e2, for GNU/Linux 3.2.0, not stripped
RELOCATION RECORDS FOR [.text]: OFFSET TYPE VALUE 0000000000000007 R_X86_64_PC32 .rodata-0x0000000000000004 000000000000000f R_X86_64_PLT32 puts-0x0000000000000004 000000000000001e R_X86_64_PLT32 add-0x0000000000000004 0000000000000027 R_X86_64_PC32 .rodata+0x0000000000000006 0000000000000034 R_X86_64_PLT32 printf-0x0000000000000004 000000000000003a R_X86_64_PC32 value-0x0000000000000004 0000000000000043 R_X86_64_PC32 .rodata+0x000000000000000e 0000000000000050 R_X86_64_PLT32 printf-0x0000000000000004
RELOCATION RECORDS FOR [.eh_frame]: OFFSET TYPE VALUE 0000000000000020 R_X86_64_PC32 .text
size观察代码数据段的长度
1 2 3 4 5
┌──(root㉿Executor)-[/mnt/c/Users/86135/desktop/COFF] └─# size main text data bss dec hex filename 140652881942796 main ;text代码段长度(10进制) data数据段长度(10进制) bss未初始化数据段(10进制) dec这三个段长度和(10进制) hex这三个段的长度和(16进制)
Symbol table '.symtab' contains 12 entries: Num: Value Size Type Bind Vis Ndx Name 0: 0000000000000000 0 NOTYPE LOCAL DEFAULT UND 1: 0000000000000000 0 FILE LOCAL DEFAULT ABS test.c 2: 0000000000000000 0 SECTION LOCAL DEFAULT 1 .text 3: 0000000000000000 0 SECTION LOCAL DEFAULT 3 .data 4: 0000000000000000 0 SECTION LOCAL DEFAULT 4 .bss 5: 0000000000000004 4 OBJECT LOCAL DEFAULT 3 static_initialized 6: 0000000000000004 4 OBJECT LOCAL DEFAULT 4 static_uninitialized 7: 0000000000000000 0 SECTION LOCAL DEFAULT 5 .rodata 8: 0000000000000000 4 OBJECT GLOBAL DEFAULT 3 global_initialized 9: 0000000000000000 4 OBJECT GLOBAL DEFAULT 4 global_uninitialized 10: 0000000000000000 70 FUNC GLOBAL DEFAULT 1 main 11: 0000000000000000 0 NOTYPE GLOBAL DEFAULT UND printf
栏目
意义
Num
符号表数组中的下标
Value
st_value符号值
Size
st_size符号大小
Type
st_info低四位符号类型
Bind
st_info高四位符号绑定信息
Vis
st_other尚未使用,都是DEFAULT
Ndx
st_shndx
Name
符号名称
nm观察符号表
1 2 3 4 5 6 7 8 9 10 11 12 13
┌──(root㉿Executor)-[/mnt/c/Users/86135/desktop/COFF] └─# nm -a test.o 0000000000000000 b .bss 0000000000000000 d .data 0000000000000000 D global_initialized 0000000000000000 B global_uninitialized 0000000000000000 T main U printf 0000000000000000 r .rodata 0000000000000004 d static_initialized 0000000000000004 b static_uninitialized 0000000000000000 a test.c 0000000000000000 t .text
