CODEWITHSUNDEEP
linuxelf
Naseer
Naseer

Reputation: 1745

vmlinux ELF find offsets for members of a given struct

In the Linux kernel, I need to find the offsets of member variables of a struct that is used. For example, for the init_task which is of type task_struct, I would like the offsets of its pid and tasks.

I only have the vmlinux present for this. I can refer to the open source kernel code, but it may differ from the build I have.

Is it possible to get the offsets without the source ?

EDIT: The vmlinux is for ARM, and I may not always be able to run C code on the target device.

Upvotes: 4

Views: 1902

Answers (3)

ephemient
ephemient

Reputation: 204718

The size and layout of structures is present in the debugging information of the compiled object files (if you compile with -g and don't strip).

pahole (aka "poke-a-hole", packaged as dev-util/dwarves in Gentoo) reads an object's DWARF debugging information to output information about "holes" in structures -- that may be a good starting point for you.

Upvotes: 2

Naseer
Naseer

Reputation: 1745

Found another solution with arm-eabi-gdb - I can do print &init_task and print &init_task.pid and the difference is the offset.

Upvotes: 0

DigitalRoss
DigitalRoss

Reputation: 146053

6.47 Offsetof

GCC implements for both C and C++ a syntactic extension to implement the offsetof macro.

 primary:
         "__builtin_offsetof" "(" typename "," offsetof_member_designator ")"

 offsetof_member_designator:
           identifier
         | offsetof_member_designator "." identifier
         | offsetof_member_designator "[" expr "]"

This extension is sufficient such that

 #define offsetof(type, member)  __builtin_offsetof (type, member)

is a suitable definition of the offsetof macro. In C++, type may be dependent. In either case, member may consist of a single identifier, or a sequence of member accesses and array references.

Upvotes: 1

Related Questions