I just want to find out all the locations that call the standard library function pthread_attr_getstack
using ida pro. There is an entry in .plt:
.plt:00015894 ; =============== S U B R O U T I N E =======================================
.plt:00015894
.plt:00015894 ; Attributes: thunk
.plt:00015894
.plt:00015894 ; int pthread_attr_getstack(const pthread_attr_t *attr, void **stackaddr, size_t *stacksize)
.plt:00015894 pthread_attr_getstack
.plt:00015894 ADRL R12, 0x3AD89C
.plt:0001589C LDR PC, [R12,#(pthread_attr_getstack_ptr - 0x3AD89C)]! ; __imp_pthread_attr_getstack
.plt:0001589C ; End of function pthread_attr_getstack
If I double click the __imp_pthread_attr_getstack
, it will go to:
extern:003D8520 ; int pthread_attr_getstack(const pthread_attr_t *attr, void **stackaddr, size_t *stacksize)
extern:003D8520 IMPORT __imp_pthread_attr_getstack
extern:003D8520 ; CODE XREF: pthread_attr_getstack+8↑j
extern:003D8520 ; DATA XREF: .got:pthread_attr_getstack_ptr↑o
And if I double click pthread_attr_getstack+8↑j
, it will go to the above .plt entry, and if I double click .got:pthread_attr_getstack_ptr↑o
, it will go to one .got entry:
.got:003ADD8C pthread_attr_getstack_ptr DCD __imp_pthread_attr_getstack
.got:003ADD8C ; DATA XREF: pthread_attr_getstack+8↑r
And if I double click the pthread_attr_getstack+8↑r
in the .got entry, it will go to the above .plt entry as well. Does this mean that there is no code calling pthread_attr_getstack
? If the answer is no, then how to find out all of locations calling pthread_attr_getstack
?
By the way, this is the elf which is named libmono.so that I want to reverse.
One thing to emphasis, the libmono.so elf file is very liked to be encrypted, that is to say, there may be a lot of obfuscated code in libmono.so.