CODEWITHSUNDEEP
functiongcc
sherlock
sherlock

Reputation: 2807

How can I get the number of bytes a C function is compiled to?

Assuming I am compiling the C source code with gcc, is it possible to know how many bytes each user defined function is compiled to? The resulting ELF binary contains the symbol addresses for function symbols (assuming the binary is not stripped), but is it anyway possible to retrieve the address of the last byte of the function?

The reason I need this information is because I need to write a little static obfuscator/encryptor for ELF binaries. Reversing/disassembling is the sub-optimal solution which I am currently adapting. Finding for function epilogue is not very bulletproof solution indeed. However, gcc can easily spit out this information as part of the compilation process.

Upvotes: 0

Views: 456

Answers (1)

Jens
Jens

Reputation: 72639

All compilers place the information about the size of functions and other tidbits in the symbol table. Use nm to inspect this name list. For example, to find the size of the main function of the indent executable (which must not be stripped), use

$ nm -AP indent|grep " main "
indent: main T 0000000000401600 000000000000051d

The 'T' indicates a public symbol in the text segment. The main function is 0x51d bytes long.

Your nm(1) manual page has all the details. BTW, you can also run nm on object files, which usually are not stripped.

Upvotes: 1

Related Questions