Find functions names in .init_array section in unstripped library

Question

Is it possible to find out all instances of static initialization in a elf dynamic library. I can dump the array of function pointers in .init_array section via objdump command like this. objdump -s -j .init_array <libname.so>

Is there a way to map these function pointers back to function names. I have unstripped library with debug symbols.

Answer 1

This can easily be achieved with radare2. I have this version installed

[rese] r2 -v
radare2 4.6.0-git 25072 @ linux-x86-64 git.4.4.0-486-ga5e8cf0c9
commit: a5e8cf0c9bd94e5f8d679e281c486584f23251e3 build: 2020-07-28__11:41:47

Enable .init_array in a program as such

#include <stdio.h>
static void f1(void) __attribute__((constructor));
static void f2(void) __attribute__((constructor));
static void f3(void) __attribute__((constructor));

void f1() { puts(__FILE__ ":f1"); }
void f2() { puts(__FILE__ ":f2"); }
void f3() { puts(__FILE__ ":f3"); }

int main(int argc, char **argv) {
    puts(__FILE__ ":main");
    return 0;
}

Which works as expected

[rese] make test
cc     test.c   -o test
[rese] ./test
test.c:f1
test.c:f2
test.c:f3
test.c:main

Use the pxr to annotate while dumping as hex

[rese] r2 -AA -qq -c 'pxr 0x30 @ sym..init_array' test 
0x00200da0 0x0000000000000680   ........ @loc.__init_array_start 1664 (.text) sym.frame_dummy entry.init0 R X 'push rbp'
0x00200da8 0x000000000000068a   ........ 1674 (.text) sym.f1 sym.f1 R X 'push rbp'
0x00200db0 0x000000000000069d   ........ 1693 (.text) sym.f2 sym.f2 R X 'push rbp'
0x00200db8 0x00000000000006b0   ........ 1712 (.text) sym.f3 sym.f3 R X 'push rbp'
0x00200dc0 0x0000000000000640   @....... @loc.__init_array_end 1600 (.text) sym.__do_global_dtors_aux sym.__do_global_dtors_aux R X 'cmp byte [rip + 0x2009c9], 0'
0x00200dc8 0x0000000000000001   ........ @obj._DYNAMIC 0 loc.imp._ITM_deregisterTMCloneTable R X 'jg 0x47'