How to see the GNU debuglink value of an ELF file?

Question

So I can add a link to a debug symbol file like this objcopy --add-gnu-debuglink=$name.dbg $name, but how can I later retrieve that value again?

I checked with readelf -a and grepped for \.dbg without any luck. Similarly I checked the with objdump -sj .gnu_debuglink (.gnu_debuglink is the section) and could see the value there:

$ objdump -sj .gnu_debuglink helloworld|grep \.dbg
0000 68656c6c 6f776f72 6c642e64 62670000  helloworld.dbg..

However, would there be a command that allows me to extract the retrieve the exact value again (i.e. helloworld.dbg in the above example)? That is the file name only ...

I realize I could use some shell foo here, but it seems odd that an option exists to set this value but none to retrieve it. So I probably just missed it.

Okwu

Answer 1

You can use readelf directly:

$ readelf --string-dump=.gnu_debuglink helloworld

String dump of section '.gnu_debuglink':
  [     0]  helloworld
  [    1b]  9

I do not know what the second entry means (it seems to always be different). To get rid of the header and the offsets, you can use sed:

$ readelf --string-dump=.gnu_debuglink helloworld | sed -n '/]/{s/.* //;p;q}'
helloworld

Axe

The second entry is probably readelf's attempt to render the CRC of the debuglink file. – Indigestive

readelf -wk works nicely – Hetzel

Answer 2

Something like this should work:

objcopy --output-target=binary --set-section-flags .gnu_debuglink=alloc \
  --only-section=.gnu_debuglink helloworld helloworld.dbg

--output-target=binary avoids adding ELF headers. --set-section-flags .gnu_debuglink=alloc is needed because objcopy only writes allocated sections by default (with the binary emulation). And --only-section=.gnu_debuglink finally identifies the answer. See this earlier answer.

Note that the generated file may have a trailing NUL byte and four bytes of CRC, so some post-processing is needed to extract everything up to the first NUL byte (perhaps using head -z -n 1 helloworld.dbg | tr -d '\0' or something similar).

Knopp