3

I'm fairly new to reversing, and I have even less experience with IDA Pro. I am wondering if there is a way to figure out from where an imported function is imported, i.e. a memory location I can find with ldd or even better a .so name.

2 Answers 2

5

When I had the same problem (I was working on ELF binaries from Linux and QNX systems) I had to do the following:

  • run ldd on the executable to get the list of loaded libraries
  • obtain a list of exports of each mentioned library (by running nm -CD full_library_name | grep " T " on the system)
  • If your function is there - it is there
  • If you are working with C++, take demangling into consideration

If you don't have an ability to use shell on your system, you can automate getting list of exports using IDAPython ( idautils.Entries() ) and -S ida command line option.

If the library is loaded dynamically (by using dlopen/dlsym for example) you'll have to find corresponding dlopen call and find out its arguments.

1

Created this plugin recently, you can use https://github.com/0xMirasio/AutoResolv. This is an IDA plugins for resolving imports and show the library origin. You can also refactor code by importing function signature from the libs.

2
  • 1
    Welcome to RE.SE. It is customary to disclose one's affiliation with a recommendation. In this case you seem to be the owner of the repo, right? Note: there's nothing wrong with promoting a solution you created, but it's good style to say that you are the one who made it when you are promoting it (also holds for noncommercial offerings like yours). Thanks.
    – 0xC0000022L
    Sep 19, 2022 at 11:47
  • 1
    Ok , going to edit Sep 20, 2022 at 12:05

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.