I'm fairly new to reversing, and I have even less experience with IDA Pro. I am wondering if there is a way to figure out from where an imported function is imported, i.e. a memory location I can find with ldd or even better a .so name.
When I had the same problem (I was working on ELF binaries from Linux and QNX systems) I had to do the following:
lddon the executable to get the list of loaded libraries
- obtain a list of exports of each mentioned library (by running
nm -CD full_library_name | grep " T "on the system)
- If your function is there - it is there
- If you are working with C++, take demangling into consideration
If you don't have an ability to use shell on your system, you can automate getting list of exports using IDAPython (
idautils.Entries() ) and -S ida command line option.
If the library is loaded dynamically (by using
dlopen/dlsym for example) you'll have to find corresponding
dlopen call and find out its arguments.
Created this plugin recently, you can use https://github.com/0xMirasio/AutoResolv. This is an IDA plugins for resolving imports and show the library origin. You can also refactor code by importing function signature from the libs.