CS32, Fall 2012

Lab08:
Inspecting object/load modules

Goals for this lab

By the time you have completed this lab you should be able to

Identify and interpret file types with the file command.
Inspect object and load module contents and structure with command line tools, strings, nm, objdump and readelf
Explain key memory concepts for C and C++ programs

Step by Step Instructions

Step 0: TA evaluations

The first order of business this week is to fill out end-of-term evaluations for your Teaching Assistant(s). Please complete this task before proceeding to Step 1. Thank you!

Step 1: Choose roles, log in, and get a file

Partner up (and remember to switch roles after a while). If your regular partner is more than 5 minutes late, ask the TA to pair you with someone else for this week.
Download lab08.cpp and save it into ~/cs32/lab08

Step 2: Compile, link separately, and begin exploring the binaries

First compile with both -g and -c flags to provide debugging information and write the object module, lab08.o to disk:
```
g++ -g -c lab08.cpp
```
Now create the executable file from this object file:
```
g++ -o lab08 lab08.o
```
Next, read and interpret the output of the file command for the three files:
```
-bash-4.2$ file lab08*
lab08:     ELF 32-bit LSB executable, Intel 80386, version 1 (SYSV), dynamically
           linked (uses shared libs), for GNU/Linux 2.6.32, not stripped
lab08.cpp: ASCII text
lab08.o:   ELF 32-bit LSB relocatable, Intel 80386, version 1 (SYSV),
           not stripped
```
ELF stands for "Executable and Linking Format" as you learned from the Reader and lecture, LSB means "Linux Standard Base" (a collection of APIs meant to be supported by all Linux systems), and SYSV abbreviates "UNIX System V." What else can you learn from these results? And what do you suppose "not stripped" means?
The strings command can be used to list the strings in a binary file. For example, the relocatable object file (lab08.o) has two strings:
```
-bash-4.2$ strings lab08.o
element 
 is 
```
Did you read the source code? If so, then these strings should look familiar. Meanwhile, the executable file contains many more strings. Try `strings lab08` to see them.

Step 3: Inspect object module names/sections with `nm` and `objdump`

The command nm lists the "names" (symbols) in an object or load module, and objdump displays various information about such files. Both commands have useful options that are worth learning.

Show the names in lab08.o:

-bash-4.2$ nm lab08.o
000000fa t _GLOBAL__sub_I_a
000000ba t _Z41__static_initialization_and_destruction_0ii
00000010 r _ZL1M
         U _ZNSolsEPFRSoS_E
         U _ZNSolsEi
         U _ZNSt8ios_base4InitC1Ev
         U _ZNSt8ios_base4InitD1Ev
         U _ZSt4cout
         U _ZSt4endlIcSt11char_traitsIcEERSt13basic_ostreamIT_T0_ES6_
00000028 b _ZStL8__ioinit
         U _ZStlsISt11char_traitsIcEERSt13basic_ostreamIcT_ES5_PKc
00000028 d _ZZ4mainE1k
         U __cxa_atexit
         U __dso_handle
00000000 D a
00000000 B b
00000000 T main

The values on the left side are addresses in hexadecimal, and you can show these values in decimal with the "-td" option. The next column shows the class of each symbol, where T and t are functions, D and d are data (global variables), r is read-only data, B and b are uninitialized data, and U is undefined.

Notice the names are shown in their "mangled" form by default. For example, "_ZL1M" is really just the global constant M, "_ZNSolsEi" is "std::ostream::operator<<(int)" in more familiar notation. The "-C' option will decode (demangle) such symbols for you. Try it now.
By the way, the default format for nm, "BSD format" is more difficult to read than "System V format" which can be achieved with the "-f sysv" option. Try that now too.

Using objdump can reveal more details about object files. At least one option must be specified.

Try it first with the "-S" option - and always pipe the results through more to view one screenful at a time:
```
objdump -S lab08.o | more
```
Try it now. According to man, the "-S" option will "display source code intermixed with disassembly, if possible. Implies -d" where "-d" means disassemble the code.
Use man objdump or read the man page at http://sourceware.org/binutils/docs/binutils/objdump.html#objdump to learn about more options. You might like the "-l" (ELL) option in particular - use it along with the "-d" option as follows:
```
objdump -d -l lab08.o | more
```
Try some other option switches. Notice for example that "-C" serves the same purpose it did for the nm command. Do you remember that purpose? The -j option lets you specify "just" particular sections. Interesting sections include .text, .data, .rodata, and .ctors, among others.

Step 4: Inspect executable module with `readelf`

Although you could use objdump to inspect this load module, the readelf tool gives more information about load modules (so called because they are ready to be loaded into memory for execution). As with objdump, at least one option must be specified.

First learn about readelf from its man page (at the console or here: http://sourceware.org/binutils/docs/binutils/readelf.html#readelf).
Did you notice that the "-S" option has a different meaning for readelf than it does for objdump? It means "Display the sections' header" for readelf. Use it now to find out the names of the sections in lab08:
```
readelf -S lab08
```
Finally, find answers to the following questions in case the TA asks you about them:
1. What is the name of the section with the program's instructions?
2. In what section is the array named a stored?
3. In what section is the constant M stored?
4. In what section is the static variable k stored?
5. How is the array b handled differently than other variables?
6. The variable i is handled differently too. How?
  (Hint: remember what you know about "automatic" data storage.)

Step 5: Show off your work and get credit for the in-lab requirements

First be sure you know the answers to all of questions a through f listed at the end of Step 4. Then ...

Get your TA's attention to inspect your work, and to record completion of your in-lab work.

This time you may leave early! But be sure to get checked off first.

Step 5a. ONLY IF YOU RAN OUT OF TIME TO HAVE THE TA INSPECT YOUR WORK

If you must complete this assignment at CSIL, then submit it with the turnin program - but do NOT turn it in if the TA already checked you off.

First create a text file named lab08.txt, and type answers to each of the six questions at the end of Step 4 above. You MUST have both your name and your partner's name in lab08.txt in order to receive credit.

Bring up a terminal window on CSIL, and cd into the original pilot's ~/cs32/lab08 directory. Then type the following to turn in your text file:
turnin lab08@cs32 lab08.txt

Evaluation and Grading

Each pair of students must accomplish the following to earn full credit for this lab:

Completed and turned in TA evaluation(s).
You can tell the TA the answers to each of the six questions listed in Step 4.
ONLY IF STEP 5a IS NECESSARY - lab08.txt has been turned in.
Deadline for after-lab submission: Thursday, November 29 (11:59pm)
Note that to be eligible for late turn-in with credit, you MUST have attended your entire lab period (but did not have time to be checked off).

No Homework this week

Prepared by Michael Costanzo.