6

I've been doing an exersice in attempt to understanding some of what's going on under the hood of a program. I wrote a small C program, and compiled it on i386 Linux (Ubuntu 12.04) using gcc. I then did a hexdump -C on the output to text file. I noticed that there were some gaps on the offset with an *:

00000670  00 3f 1a 3b 2a 32 24 22  1c 00 00 00 40 00 00 00  |.?.;*2$"....@...|
00000680  94 fd ff ff 05 01 00 00  00 41 0e 08 85 02 42 0d  |.........A....B.|
00000690  05 03 01 01 c5 0c 04 04  38 00 00 00 60 00 00 00  |........8...`...|
000006a0  80 fe ff ff 61 00 00 00  00 41 0e 08 85 02 41 0e  |....a....A....A.|
000006b0  0c 87 03 41 0e 10 86 04  41 0e 14 83 05 4e 0e 30  |...A....A....N.0|
000006c0  02 4a 0e 14 41 0e 10 c3  41 0e 0c c6 41 0e 08 c7  |.J..A...A...A...|
000006d0  41 0e 04 c5 10 00 00 00  9c 00 00 00 b4 fe ff ff  |A...............|
000006e0  02 00 00 00 00 00 00 00  10 00 00 00 b0 00 00 00  |................|
000006f0  a2 fe ff ff 04 00 00 00  00 00 00 00 00 00 00 00  |................|
00000700  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
*
00000f10  00 00 00 00 ff ff ff ff  00 00 00 00 ff ff ff ff  |................|
00000f20  00 00 00 00 00 00 00 00  01 00 00 00 10 00 00 00  |................|
00000f30  0c 00 00 00 d4 82 04 08  0d 00 00 00 cc 85 04 08  |................|
00000f40  f5 fe ff 6f ac 81 04 08  05 00 00 00 2c 82 04 08  |...o........,...|
00000f50  06 00 00 00 cc 81 04 08  0a 00 00 00 54 00 00 00  |............T...|
00000f60  0b 00 00 00 10 00 00 00  15 00 00 00 00 00 00 00  |................|
00000f70  03 00 00 00 f4 9f 04 08  02 00 00 00 20 00 00 00  |............ ...|
00000f80  14 00 00 00 11 00 00 00  17 00 00 00 b4 82 04 08  |................|
00000f90  11 00 00 00 ac 82 04 08  12 00 00 00 08 00 00 00  |................|
00000fa0  13 00 00 00 08 00 00 00  fe ff ff 6f 8c 82 04 08  |...........o....|
00000fb0  ff ff ff 6f 01 00 00 00  f0 ff ff 6f 80 82 04 08  |...o.......o....|
00000fc0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
*
00000ff0  00 00 00 00 28 9f 04 08  00 00 00 00 00 00 00 00  |....(...........|
00001000  26 83 04 08 36 83 04 08  46 83 04 08 56 83 04 08  |&...6...F...V...|
00001010  00 00 00 00 00 00 00 00  47 43 43 3a 20 28 55 62  |........GCC: (Ub|
00001020  75 6e 74 75 2f 4c 69 6e  61 72 6f 20 34 2e 36 2e  |untu/Linaro 4.6.|
00001030  33 2d 31 75 62 75 6e 74  75 35 29 20 34 2e 36 2e  |3-1ubuntu5) 4.6.|
00001040  33 00 00 2e 73 79 6d 74  61 62 00 2e 73 74 72 74  |3...symtab..strt|
00001050  61 62 00 2e 73 68 73 74  72 74 61 62 00 2e 69 6e  |ab..shstrtab..in|
00001060  74 65 72 70 00 2e 6e 6f  74 65 2e 41 42 49 2d 74  |terp..note.ABI-t|
00001070  61 67 00 2e 6e 6f 74 65  2e 67 6e 75 2e 62 75 69  |ag..note.gnu.bui|
00001080  6c 64 2d 69 64 00 2e 67  6e 75 2e 68 61 73 68 00  |ld-id..gnu.hash.|
00001090  2e 64 79 6e 73 79 6d 00  2e 64 79 6e 73 74 72 00  |.dynsym..dynstr.|

My question is, how should I interpret the *? I assume it means there's a gap in the file, but then the question turns to why does a gap exist? Is this part of the standard format of an ELF file?

9

Like in the standard od command or hd, it means all the elided lines are the same as the preceding line. You can pass -v to make it display those lines anyway. From hexdump(1):

The -v option causes hexdump to display all input data. Without the -v option, any number of groups of output lines, which would be identical to the immediately preceding group of output lines (except for the input offsets), are replaced with a line comprised of a single asterisk.

  • Doh! It was in the man file and I missed it... Thanks! – Chad Harrison Sep 24 '13 at 15:25

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.