Recently I worked on a Linux program which has all of its symbols stripped. Opening it with IDA resulted in none of its functions identified.
Thus I tried to extract any usable information from the executable file with the
file commands, but these sadly found nothing.
I know about the FLIRT technology in IDA, but it is based on knowing the version of the static library so it can use the correct signature file. In this case it seems we have no any version information for the used
glibc or other libraries, so what should we do now?
$ file stripped ELF 32-bit LSB executable, Intel 80386, version 1 (SYSV), statically linked, for GNU/Linux 2.2.5, stripped
With the outpuf of
file as shown above, can I retrieve more details from this? Or is the solution that we can only recognize it via our experience?