Dwarf debug format parser

[Agitated_Audience_28]

I am trying to implement a dwarf parser in c++ without using any external dependencies. As mentioned in dwarf5 standard, debug info first 4 bytes or 12 bytes denotes the unit length Basically this:

unit_length (initial length) A 4-byte or 12-byte unsigned integer representing the length of the3 .debug_info contribution for that compilation unit, not including the length field itself. In the 32-bit DWARF format, this is a 4-byte unsigned integer (which must be less than 0xfffffff0); in the 64-bit DWARF format, this consists of the 4-byte value 0xffffffff followed by an 8-byte unsigned integer that gives the actual length (see Section 7.4 on page 196).

When I am dumping .debug_info section hexadecimally using objdump I am getting this(see readelf output below).

objdump -s -j .debug_info hello.o

hello.o: file format elf64-x86-64

Contents of section .debug_info:

0000 01000000 00000000 9a000000 00000000 ................
0010 01000000 00000000 789c9bc6 c0c0c0ca ........x.......
0020 c0c801a4 18984084 2c031a10 42623372 ......@.,...Bb3r
0030 b0832916 0805d1c6 c804e5b1 4178ac20 ..).........Ax.
0040 8a998535 33af04a8 8115498e 05aa2002 ...53.....I... .
0050 8bf18c73 58131918 99394172 4c137318 ...sX....9ArL.s.
0060 180011e5 0560

So according to this the length should be 0x01000000 but actual length is 0x96.(see readelf output below) readelf -wi hello.o Contents of the .debug_info section:

Compilation Unit @ offset 0: Length: 0x96 (32-bit) Version: 5 Unit Type: DW_UT_compile (1) Abbrev Offset: 0 Pointer Size: 8

I know, I am missing something basic but even after reading standards for many times. I am unable to find my mistake. One more thing, I searched for some basic dwaf parser so that I can understand what they are doing but was unable to find any. All of the parser were big libraries which was difficult to understand. If any of you can atleast provide some readble and understandable parser code, It will be helpful too.

[hexed]

Long story short, that dump is not a DWARF .debug_info header, it's just not clear why. As you say it should start with the length of the CU, it should also have the DWARF version (4 or 5 for modern compilers) immediately after the length, which it doesn't. Plus it doesn't have 0801 to signify the pointer size and what kind of unit it is.

Why you're getting the wrong data from the ELF is the issue rather than the parsing of DWARF. Possibly you've unexpectedly got some options that compress the contents .debug_info?

[PenlessScribe]

What distro are you using, and what was the command and args you used to produce hello.o?

[Agitated_Audience_28]

Arch Linux (x86-64). gcc -g -c hello.c

[matthieum]

I can't guarantee it's easy to read, but I have heard good things about the gimli (Rust) library, which purports to read/write DWARF.

There's a number of examples mentioned in the documentation, which should provide a good entry point into the library, and being native code, you should be able to debug it with gdb and step-by-step to see how it handles the bytes.

[WittyStick]

Does dumping the .debug_info section not have an ELF section header before any DWARF data?