1

I read in another SO thread:

With static libraries, the unit of copying is the object file in the library.

In other words, if two programs call a function from a certain object file, both programs end up with all of the object file in the executable.

Yet, the above answer is from 2012 and I was wondering if newer linkers have come up with smarter solutions, that is, solution that only copy those functions into the executable that are actually needed (e.g. because other functions depend on them).

  • Are there any general reasons why this is not a good idea or impossible?
  • Is there a way I can find out dependencies between functions inside a static library? Does the linker or the linking process provide this information?

By the term dependency I mean the fact that a certain library function is always copied together with another function into the executable.

My overall goal is the following:

I have an unknown binary but I know it contains code from a certain static library. I don't know the version of the library. I also know that this executable uses a certain function from this static library. I would like to know which other functions are also in the executable (no matter if actually used or not).

Thanks for any answers, remarks or ideas.

Improve this question
3
  • Have you considered BinDiff'ing to identify similarities? It's now free zynamics.com/software.html
    – Codoka
    Commented Jun 23, 2016 at 7:04
  • @0xcode what exactly do you mean ? Diffing what against what? What should be similar? How could it help me achieve my goal?
    – langlauf.io
    Commented Jun 23, 2016 at 14:46
  • Basically, given a compiled version of the static library you already know about, you might consider doing binary-level diffing for each individual function, i.e., check whether there are "similar" functions to it in your unknown binary.
    – Codoka
    Commented Jun 24, 2016 at 10:48

1 Answer 1

Reset to default
2

You are actually asking multiple different questions here :

[Regarding static linking only a few functions of a library]

Are there any general reasons why this is not a good idea or impossible?

Well it could be possible if it's your code and you know what you are doing (basically making a new library that is a subpart of the first one), but otherwise there's just no simple way to forsee which parts of the object file you are going to use in a general case.

Is there a way I can find out dependencies between functions inside a static library? Does the linker or the linking process provide this information?

That would really depend on your library. It might be possible in some case, but outright impossible in other cases. If your library is simple enough and clean enough, it could be easy though.

I have an unknown binary but I know it contains code from a certain static library. I also know that this executable uses a certain function from this static library. I would like to know which other functions are also in the executable (no matter if actually used or not).

That's a totally different problem! I'm not sure I perfectly understand your question, because if you know which static library is linked, you already know that the whole library is in your binary and basically reachable. You can then propagate this information with the usual tools (FLIRT signatures, Diaphora, Rizzo, etc.).

If you know the library, but not the exact version, you'd usually have to craft an heuristic in order to compare the lib in your binary with multiple versions of this library. (That might also depend on your guessing the compilation parameters if you only have the source code).

If you have no clue about the library that's being use, I guess you'd just have to either make a blind guess or to reverse the whole thing.

Improve this answer
9
  • Good point, Indeed, I know the library but not the version. And yes, I am thinking about a heuristic how to compare it with multiple versions. My intution was that the answer to my questions would help in coming up with a suitable heuristic
    – langlauf.io
    Commented Jun 22, 2016 at 17:29
  • Let's assume my library is clean enough. How would you try to get the dependencies?
    – langlauf.io
    Commented Jun 22, 2016 at 17:34
  • 1
    Regarding the dependencies of a single function in the library, I'd go for some IDA Python. A really naive first approach would be to include anything that has a xref from your function, and to double-check there is no pointer arithmetic whatsoever.
    – user2823000
    Commented Jun 22, 2016 at 23:02
  • Regarding the heuristic, it's really a case-by-case specific problem. If you know the compilation settings, just go with the usual tools stated in my answer. If you only have the source code, I'd try to match either the function prototypes or the error messages as generic pieces of advice, but it's hard to tell if that'll be suited to your library.
    – user2823000
    Commented Jun 22, 2016 at 23:07
  • 1
    Don't forget to recursively apply your algorithm on any function and ressources it'll find. Well there is no guarantee here, with such a static, you have no way to be sure you either missed computer paths or followed some behind opaque predicates.
    – user2823000
    Commented Jun 23, 2016 at 16:30

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.