Linux readelf shows object sizes with different numeral system (Hex and Dec)

I’m investigating some objects inside ELF file and using readelf for that purpose.

This sample of readelf shows the size (bytes) of the objects on column 3,

On large objects, readelf prints in Hex instead of dec,

This breaks my size sorting attempts. (sorting ignores hex value)

Num:    Value  Size Type    Bind   Vis      Ndx Name
1369: 808ec6e8  2048 OBJECT  LOCAL  DEFAULT   26 _ZN2cvL12NNDeltaTab_iE
1370: 8086e6e8 0x20000 OBJECT  LOCAL  DEFAULT   26 _ZN2cvL13Lanczos4Tab_iE

I tried translating all hex to dec like this:

readelf -sW target.elf | perl -pe 's/(0x)?[0-9a-f]{5,}/hex $&/ge' | sort -k 3 -n -r

and got

  1369: 2156840680  2048 OBJECT  LOCAL  DEFAULT   26 _ZN2cvL12NNDeltaTab_iE
  1370: 2156324584 131072 OBJECT  LOCAL  DEFAULT   26 _ZN2cvL13Lanczos4Tab_iE

The size column (3) is translated to dec, which is good,

But also column 2 is translated to dec which is bad..

I found this:

perl -lane '$F[1]=~tr/A/B/;print join("t", @F)' file

from

find-and-replace-confined-to-a-specific-column-one-liner

But I can’t seem to combine those 2 commands.

How can I translate only column 3 to dec?

Thanks

Answer

Only convert sequences that start with 0x:

perl -pe's/0x([0-9a-f]+)/hex $1/ge'

Only convert fields that start with 0x:

perl -pe's/(?<!S)0x([0-9a-f]+)/hex $1/ge'

Only convert the third field if it’s starts with 0x:

perl -pe's/^(?:S+s+){2}K0x([0-9a-f]+)/hex $1/e'

Advertisement

Answer