Unfortunately the binutils developer chose to change the display of little-endian readelf dumps in version 2.17.50.0.10. The former behaviour was to display the bytes from right to left, with the effect, that you can directly read addresses, pointer-values, and multi-byte values in general. Addtionally the nibbles are contiguous. For example in a .got.plt dump you can see in the rightmost slot, that it points at the .dynamic section, which in this case starts at 0x08049f4c (leftmost is the address of the dumped section itself, followed by 4 .got.plt slots): $ readelf -x 10 sizetest Hex dump of section '.got.plt': 0x08049ff4 08048246 00000000 00000000 08049f4c L...........F... In the new version you have to reorder the bytes: $ readelf -x 10 ~dirk/ksrc/asm/start/sizetest Hex dump of section '.got.plt': 0x08049ff4 4c9f0408 00000000 00000000 46820408 L...........F... If someone else prefers the previous behaviour, this patch restores it. I also proposed a patch at binutils' bugzilla, which adds some notes to the manual and the dump preamble, because the main reason for the removal seems to be confusion about the reversing, according to the binutils mailing list archives http://sourceware.org/bugzilla/show_bug.cgi?id=4700 http://sourceware.org/ml/binutils/2007-01/msg00055.html --- ./binutils/readelf.c.msb-only 2007-06-25 20:14:55.000000000 +0200 +++ ./binutils/readelf.c 2007-06-25 14:21:48.000000000 +0200 @@ -7669,30 +7665,49 @@ dump_section (Elf_Internal_Shdr *section while (bytes) { int j; int k; int lbytes; lbytes = (bytes > 16 ? 16 : bytes); printf (" 0x%8.8lx ", (unsigned long) addr); + switch (elf_header.e_ident[EI_DATA]) + { + default: + case ELFDATA2LSB: + for (j = 15; j >= 0; j --) + { + if (j < lbytes) + printf ("%2.2x", data[j]); + else + printf (" "); + + if (!(j & 0x3)) + printf (" "); + } + break; + + case ELFDATA2MSB: for (j = 0; j < 16; j++) { if (j < lbytes) printf ("%2.2x", data[j]); else printf (" "); if ((j & 3) == 3) printf (" "); } + break; + } for (j = 0; j < lbytes; j++) { k = data[j]; if (k >= ' ' && k < 0x7f) printf ("%c", k); else printf ("."); } Reproducible: Always
