Search code examples
clinuxpointersipinstructions

Translate Instruction Pointer Address (in shared library) to Source Instruction

Are there any tools or libraries one can use on Linux to get the original (source) instruction only from the PID and the current instruction pointer address, even if the IP currently points into a shared library?

AFAIK it should be possible, since the location of the library mapping is available through /proc/[PID]/maps, though I haven't found any applications or examples doing so.

Any suggestions?

EDIT: an assembly instruction or the nearest symbol suffice (source code line is not necessarily needed)

Solution

  • I found a way to do this with GDB:

    Interactive: $ gdb --pid 1566 (gdb) info symbol 0x7fe28b8a2b79 pselect + 89 in section .text of /lib/x86_64-linux-gnu/libc.so.6 (gdb) info symbol 0x5612550f14a4 copy_word_list + 20 in section .text of /usr/bin/bash (gdb) info symbol 0x7fe28b878947 execve + 7 in section .text of /lib/x86_64-linux-gnu/libc.so.6 Shows exactly what I wanted!

    It can also be scripted: gdb -q --pid PID --batch -ex 'info symbol HEX_SYMBOL_ADDR'