美文网首页
使用 C++filt 命令还原符号表

使用 C++filt 命令还原符号表

作者: 小木桨 | 来源:发表于2022-06-14 16:15 被阅读0次

在调试 C++ 时或遇到崩溃native 崩溃栈,有些 native 函数名是经过 Mangling 的,所以看不出原始 API 命名,这时候可以使用 C++filt 来还原符号。

C++filt

C++filt 命令是 linux下的,同时MAC也支持,查询 man c++filt 使用手册:

在 Mac 下使用时,需要加 -n 参数,否则无法还原。

NAME
       c++filt - Demangle C++ and Java symbols.

SYNOPSIS
       c++filt [-_|--strip-underscore]
               [-n|--no-strip-underscore]
               [-p|--no-params]
               [-t|--types]
               [-i|--no-verbose]
               [-s format|--format=format]
               [--help]  [--version]  [symbol...]

DESCRIPTION
       The C++ and Java languages provide function overloading, which means that you can write many functions with the same name, providing that each function takes
       parameters of different types.  In order to be able to distinguish these similarly named functions C++ and Java encode them into a low-level assembler name
       which uniquely identifies each different version.  This process is known as mangling. The c++filt [1] program does the inverse mapping: it decodes
       (demangles) low-level names into user-level names so that they can be read.

       Every alphanumeric word (consisting of letters, digits, underscores, dollars, or periods) seen in the input is a potential mangled name.  If the name decodes
       into a C++ name, the C++ name replaces the low-level name in the output, otherwise the original word is output.  In this way you can pass an entire assembler
       source file, containing mangled names, through c++filt and see the same source file containing demangled names.

       You can also use c++filt to decipher individual symbols by passing them on the command line:

               c++filt <symbol>

       If no symbol arguments are given, c++filt reads symbol names from the standard input instead.  All the results are printed on the standard output.  The
       difference between reading names from the command line versus reading names from the standard input is that command line arguments are expected to be just
       mangled names and no checking is performed to separate them from surrounding text.  Thus for example:

               c++filt -n _Z1fv

       will work and demangle the name to "f()" whereas:

               c++filt -n _Z1fv,

       will not work.  (Note the extra comma at the end of the mangled name which makes it invalid).  This command however will work:

               echo _Z1fv, | c++filt -n

       and will display "f(),", i.e., the demangled name followed by a trailing comma.  This behaviour is because when the names are read from the standard input it
       is expected that they might be part of an assembler source file where there might be extra, extraneous characters trailing after a mangled name.   For
       example:

                   .type   _Z1fv, @function

相关文章

  • 使用 C++filt 命令还原符号表

    在调试 C++ 时或遇到崩溃native 崩溃栈,有些 native 函数名是经过 Mangling 的,所以看不...

  • 关于bugly的iOS符号表

    Bugly使用符号表对APP发生Crash的程序堆栈进行解析和还原。 一张图看出效果 如何生成符号表文件 这里主要...

  • CPP: c++filt

    man /usr/bin/c++filt C++FILT(1) ...

  • iOS逆向基础03-符号表

    一.什么是符号表 我们都知道iOS可以通过符号表来恢复堆栈的调用,那么什么是符号表呢? 我们可以通过符号表来还原类...

  • iOS高级强化--005:nm命令

    nm命令:打印nlist结构的符号表Symbol Table 常用命令参数 nm -pa a.o -a:显示符号表...

  • 符号表还原迷惑

    1.原因 最近观察bugly上面奔溃信息的时候,结合之前的atos还原符号表,还有自己对ASLR的概念,刹那间感觉...

  • ndk-stack使用及符号表还原

    在android开发中,对于native产生的异常,很可能会产生闪退。对于ndk和native(c、c++)开发中...

  • 命令行上传友盟dSYM(符号表)

    一、背景 当符号表过多时,友盟只能一个一个上传,很费时费力。找到了命令行批量上传符号表的方式。第一次使用,安装环境...

  • iOS 符号表恢复

    一、恢复方法符号表 1.获取已经砸壳后的app 恢复符号表需要可执行文件为单一架构, 需要使用如下命令查看是否是f...

  • 自动备份数据库数据并还原编辑

    首先使用mysqldump 将远程mysql数据库的指定表保存在本地sql文件 使用source命令还原sql文件...

网友评论

      本文标题:使用 C++filt 命令还原符号表

      本文链接:https://www.haomeiwen.com/subject/zjuzmrtx.html