Resolving symbols of statically linked libraries in a binary

Question

assuming i got an statically linked libraries (for example, openssl) inside some binary.

What is a good way to resolve the library symbols ? is there any IDA plugin for that job?

I presume that I recognize the library name & version.

Answer 1

what do you mean by resolve? if one has access to a some flavor of *nix one could run the nm command on the binaries in question.

nm -a

That command will expose any symbols used in the binaries. Typically if you see something of the order T or Text next to a symbol it means its available to be called and its probably a function. Typically if you see a U next to the symbol it generally means the binary is making a call to that function and its 'Undefined' and that's why its got a U next to it. -- The U means it needs to be resolved at run time.

If you are in a *nix flavor you can run the file command on the binaries to find out whether they are FAT files or whether they are 16/32/64 or what types of files they are. You can also use the lipo command to see info about the binaries

If they happen to be 64 bit files and you have a debugger handy and pick a symbol of interest. If the symbol is undocumented you can fairly easily start to figure out its run time parameters by loading it up in a debugger and setting a break point on the symbol. When the break point is hit go look at the registers, or better yet look at the instructions right before the break point. Typically (64 bit) you would see something on the order of registers RDI and RSI being set -- or some portions of DI and SI. Generally speaking the first argument of a function gets the DI register and the 2nd argument gets the SI register. and if you see results coming back they generally come out through the RAX (or A register). You can make your own header file with not too much work.

There is a lot more details if you want to know but there are lots of resources on the net that can be found with a little looking around.

I would post a comment but don't have enough points to do so.