Linux 如何找出程序或其他库使用了共享对象的哪些函数？

How do I find out which functions of a shared object are used by a program or an other library?

提问by lultimouomo

How do I find out which functions of a shared object are used by a program or an other library? In this specific case, I would like to see which functions in /lib/libgcc1_s.so.1 are used by an other dynamic library. Since they are dynamically linked, objdump -d doesn't resolve the function call addresses. Is there a way short of running the program in a debugger or relinking statically? Thanks,

如何找出程序或其他库使用了共享对象的哪些函数？在这种特定情况下，我想查看 /lib/libgcc1_s.so.1 中的哪些函数被其他动态库使用。由于它们是动态链接的，objdump -d 不会解析函数调用地址。有没有办法在调试器中运行程序或静态重新链接？谢谢，

Luca

卢卡

Edit:

编辑：

nm and readelf won't do, I don't need to see which symbols are present in a shared object, but which are actually used in an other object that links to it.

nm 和 readelf 不会这样做，我不需要查看共享对象中存在哪些符号，但实际上在链接到它的其他对象中使用了哪些符号。

回答by jopasserat

Maybe the nmtool can help you since it displays the symbols' names contained in a binary file.
It is as simple as ABC to use:

也许该nm工具可以帮助您，因为它显示二进制文件中包含的符号名称。
使用就像 ABC 一样简单：

nm my_binary

回答by 0xC0000022L

I'm not aware of one, even nmis of limited use for what you seem to intend. Also, preloading (of the GNU linker) could invalidate any assumptions you make after using a tool that purportedly could do that. See the ld.so man page. LD_PRELOADcan be used by anyone to override the resolution of symbols as it would occur under normal circumstances.

我不知道一个，甚至nm对您似乎打算使用的用途有限。此外，（GNU 链接器的）预加载可能会使您在使用据称可以执行此操作的工具后所做的任何假设无效。请参阅ld.so 手册页。LD_PRELOAD任何人都可以使用它来覆盖符号的分辨率，因为它在正常情况下会发生。

However, even without a debugger you can use LD_DEBUGto see which function ultimately is being used.

但是，即使没有调试器，您也可以LD_DEBUG查看最终使用的是哪个函数。

回答by karlphillip

nmwill only work if the library wasn't stripped of its symbols. However, nm -Dcould show you some info:

nm仅在库未剥离其符号时才有效。但是，nm -D可以向您展示一些信息：

nm -D /lib/libgcc_s.so.1

But there's another tool which can help you: readelf

但是还有另一个工具可以帮助您：readelf

readelf - Displays information about ELF files.

readelf - 显示有关 ELF 文件的信息。

And if you check the man pages, option -s: Displays the entries in symbol table section of the file, if it has one.

如果你检查手册页，选项-s：Displays the entries in symbol table section of the file, if it has one.

readelf -s /lib/libgcc_s.so.1

EDIT:

编辑：

Well, symbols that are not implemented inside the object you are inspecting with nm will appear with a Uflag in front of it, but nm won't tell you which library on your system implements that symbol.

好吧，未在您使用 nm 检查的对象内部实现的符号将在其前面显示一个U标志，但 nm 不会告诉您系统上的哪个库实现了该符号。

So what you are looking for can probably be achieved with a mixture of lddand nm. ldd tells which libraries your application is linked with, and nm tells which symbols are undefined (Uflag) or implemented locally (Tflag).

所以你正在寻找的东西可能可以通过ldd和nm的混合来实现。ldd 告诉您的应用程序链接到哪些库， nm 告诉哪些符号未定义（U标志）或本地实现（T标志）。

After listing all the undefined symbols (with nm) on the target application, you should iterate through all libraries reported by ldd in search of those symbols (using nm again). If you find the symbol and it's preceded by the T flag, you found it.

在列出目标应用程序上的所有未定义符号（使用 nm）后，您应该遍历 ldd 报告的所有库以搜索这些符号（再次使用 nm）。如果您找到该符号并且它前面有 T 标志，那么您就找到了它。

By the way, I just wrote this one-liner for bashto illustrate my idea. It analyses an application named winand tries to find the libraries that implement all the symbols reported as undefined.

顺便说一句，我只是为 bash写了这个单行代码来说明我的想法。它分析名为win的应用程序，并尝试查找实现所有报告为未定义的符号的库。

target="win"; for symbol in $(nm -D $target | grep "U " | cut -b12-); do for library in $(ldd $target | cut -d ' ' -f3- | cut -d' ' -f1); do for lib_symbol in $(nm -D $library | grep "T " | cut -b12-); do if [ $symbol == $lib_symbol ]; then echo "Found symbol: $symbol at [$library]"; fi ; done; done; done;

Or, if your terminal supports colors:

或者，如果您的终端支持颜色：

target="win"; for symbol in $(nm -D $target | grep "U " | cut -b12-); do for library in $(ldd $target | cut -d ' ' -f3- | cut -d' ' -f1); do for lib_symbol in $(nm -D $library | grep "T " | cut -b12-); do if [ $symbol == $lib_symbol ]; then echo -e "Found symbol: \e[1;36m$symbol3[0m at \e[1;34m$library3[0m"; fi ; done; done; done;

I'm sure someone will find a performance improvement.

我相信有人会发现性能改进。

Outputs:

输出：

Found symbol: XCreateColormap at [/usr/lib/libX11.so.6]
Found symbol: XCreateWindow at [/usr/lib/libX11.so.6]
Found symbol: XIfEvent at [/usr/lib/libX11.so.6]
Found symbol: XMapWindow at [/usr/lib/libX11.so.6]
Found symbol: XOpenDisplay at [/usr/lib/libX11.so.6]
Found symbol: __libc_start_main at [/lib/tls/i686/cmov/libc.so.6]
Found symbol: __stack_chk_fail at [/lib/tls/i686/cmov/libc.so.6]
Found symbol: glClear at [/usr/lib/mesa/libGL.so.1]
Found symbol: glClearColor at [/usr/lib/mesa/libGL.so.1]
Found symbol: glFlush at [/usr/lib/mesa/libGL.so.1]
Found symbol: glXChooseFBConfig at [/usr/lib/mesa/libGL.so.1]
Found symbol: glXChooseVisual at [/usr/lib/mesa/libGL.so.1]
Found symbol: glXCreateContext at [/usr/lib/mesa/libGL.so.1]
Found symbol: glXCreateNewContext at [/usr/lib/mesa/libGL.so.1]
Found symbol: glXCreateWindow at [/usr/lib/mesa/libGL.so.1]
Found symbol: glXGetVisualFromFBConfig at [/usr/lib/mesa/libGL.so.1]
Found symbol: glXMakeContextCurrent at [/usr/lib/mesa/libGL.so.1]
Found symbol: glXMakeCurrent at [/usr/lib/mesa/libGL.so.1]
Found symbol: glXQueryVersion at [/usr/lib/mesa/libGL.so.1]

回答by Jay Conrod

Have you looked at ltrace? It intercepts calls to shared library functions at runtime and prints information about them as they occur.

你看过ltrace吗？它在运行时拦截对共享库函数的调用，并在它们发生时打印有关它们的信息。

Since this is a dynamic solution, it wouldn't print any information for a library call made in part of your program that never gets executed. But it might still be helpful depending on your needs.

由于这是一个动态解决方案，因此它不会打印在您的程序中从未执行过的部分库调用的任何信息。但根据您的需要，它可能仍然有帮助。

回答by cons0ul

This can be achieved using technique called static analysis in Reverse Engineering

这可以使用逆向工程中称为静态分析的技术来实现

You need a Disassembler for this. See http://en.wikipedia.org/wiki/Disassembler

为此，您需要一个反汇编器。请参阅http://en.wikipedia.org/wiki/Disassembler

IDA PRO is a good disassembler witch answers your question.It is capable of reading ELF file format but unfortunately it is not free.

IDA PRO 是一个很好的反汇编器，可以回答您的问题。它能够读取 ELF 文件格式，但不幸的是它不是免费的。