I have a stripped elf file that has statically linked libraries. Is there a way that I could take the original library files that are in a files and name the functions in IDA that match those in the library?
2 Answers
probably this ida pro plugin can help syms2elf
The plugin export the symbols (for the moment only functions) recognized by IDA Pro and radare2 to the ELF symbol table. This allows us to use the power of IDA/r2 in recognizing functions (analysis, FLIRT signatures, manual creation, renaming, etc), but not be limited to the exclusive use of this tools.
Supports 32 and 64-bits file format.
EXAMPLE
Based on a full-stripped ELF:
$ file test1_x86_stripped
test1_x86_stripped: ELF 32-bit LSB executable, Intel 80386, version 1 (SYSV), dynamically linked (uses shared libs), for GNU/Linux 2.6.32, stripped
https://github.com/danigargu/ida-syms2elf
edit
another plugin wsym Adds symbols to an ELF file. Sort of the opposite of strip. This is in a very early stage of development and should be considered PoC/beta software.
https://github.com/wapiflapi/wsym
-
-
@gudenau both use IDA power of recognizing functions, syms2elf use ida pro recognizing functions (analysis, FLIRT signatures, manual creation, renaming) and output new unstripped elf file. wsym also use ida pro recognizing functions, take input .map file generated by IDA and output new unstripped elf file.(this plugin is in a very early stage of development) sorry english is not my native language– adriánJul 4, 2016 at 23:37
You need to create FLIRT signatures from the static libraries using the FLAIR kit and then apply those signatures to the loaded file. Note that this will only work if the exact same libraries were used in the binary's compilation (e.g. compilation options must match) since FLIRT relies on byte matching. For more info about FLIRT see https://www.hex-rays.com/products/ida/tech/flirt/in_depth.shtml
answered Jul 5, 2016 at 14:20
