7

I have a stripped elf file that has statically linked libraries. Is there a way that I could take the original library files that are in a files and name the functions in IDA that match those in the library?

2 Answers 2

2

You need to create FLIRT signatures from the static libraries using the FLAIR kit and then apply those signatures to the loaded file. Note that this will only work if the exact same libraries were used in the binary's compilation (e.g. compilation options must match) since FLIRT relies on byte matching. For more info about FLIRT see https://www.hex-rays.com/products/ida/tech/flirt/in_depth.shtml

1

probably this ida pro plugin can help syms2elf
The plugin export the symbols (for the moment only functions) recognized by IDA Pro and radare2 to the ELF symbol table. This allows us to use the power of IDA/r2 in recognizing functions (analysis, FLIRT signatures, manual creation, renaming, etc), but not be limited to the exclusive use of this tools. Supports 32 and 64-bits file format.
EXAMPLE
Based on a full-stripped ELF:
$ file test1_x86_stripped test1_x86_stripped: ELF 32-bit LSB executable, Intel 80386, version 1 (SYSV), dynamically linked (uses shared libs), for GNU/Linux 2.6.32, stripped
enter image description here

https://github.com/danigargu/ida-syms2elf

edit
another plugin wsym Adds symbols to an ELF file. Sort of the opposite of strip. This is in a very early stage of development and should be considered PoC/beta software.
https://github.com/wapiflapi/wsym

2
  • Do these only work on what you set in IDA?
    – gudenau
    Jul 4, 2016 at 22:03
  • @gudenau both use IDA power of recognizing functions, syms2elf use ida pro recognizing functions (analysis, FLIRT signatures, manual creation, renaming) and output new unstripped elf file. wsym also use ida pro recognizing functions, take input .map file generated by IDA and output new unstripped elf file.(this plugin is in a very early stage of development) sorry english is not my native language
    – adrián
    Jul 4, 2016 at 23:37

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.