I'm fairly new to reversing, and I have even less experience with IDA Pro. I am wondering if there is a way to figure out from where an imported function is imported, i.e. a memory location I can find with ldd or even better a .so name.
2 Answers
When I had the same problem (I was working on ELF binaries from Linux and QNX systems) I had to do the following:
- run
lddon the executable to get the list of loaded libraries - obtain a list of exports of each mentioned library (by running
nm -CD full_library_name | grep " T "on the system) - If your function is there - it is there
- If you are working with C++, take demangling into consideration
If you don't have an ability to use shell on your system, you can automate getting list of exports using IDAPython ( idautils.Entries() ) and -S ida command line option.
If the library is loaded dynamically (by using dlopen/dlsym for example) you'll have to find corresponding dlopen call and find out its arguments.
Created this plugin recently, you can use https://github.com/0xMirasio/AutoResolv. This is an IDA plugins for resolving imports and show the library origin. You can also refactor code by importing function signature from the libs.
-
1Welcome to RE.SE. It is customary to disclose one's affiliation with a recommendation. In this case you seem to be the owner of the repo, right? Note: there's nothing wrong with promoting a solution you created, but it's good style to say that you are the one who made it when you are promoting it (also holds for noncommercial offerings like yours). Thanks.– 0xC0000022L ♦Sep 19, 2022 at 11:47
-
1