2

I'm fairly new to reversing, and I have even less experience with IDA Pro. I am wondering if there is a way to figure out from where an imported function is imported, i.e. a memory location I can find with ldd or even better a .so name.

3

When I had the same problem (I was working on ELF binaries from Linux and QNX systems) I had to do the following:

  • run ldd on the executable to get the list of loaded libraries
  • obtain a list of exports of each mentioned library (by running nm -CD full_library_name | grep " T " on the system)
  • If your function is there - it is there
  • If you are working with C++, take demangling into consideration

If you don't have an ability to use shell on your system, you can automate getting list of exports using IDAPython ( idautils.Entries() ) and -S ida command line option.

If the library is loaded dynamically (by using dlopen/dlsym for example) you'll have to find corresponding dlopen call and find out its arguments.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.