1

I just want to find out all the locations that call the standard library function pthread_attr_getstack using ida pro. There is an entry in .plt: 

.plt:00015894 ; =============== S U B R O U T I N E =======================================
.plt:00015894
.plt:00015894 ; Attributes: thunk
.plt:00015894
.plt:00015894 ; int pthread_attr_getstack(const pthread_attr_t *attr, void **stackaddr, size_t *stacksize)
.plt:00015894 pthread_attr_getstack
.plt:00015894                 ADRL            R12, 0x3AD89C
.plt:0001589C                 LDR             PC, [R12,#(pthread_attr_getstack_ptr - 0x3AD89C)]! ; __imp_pthread_attr_getstack
.plt:0001589C ; End of function pthread_attr_getstack

If I double click the __imp_pthread_attr_getstack, it will go to:

extern:003D8520 ; int pthread_attr_getstack(const pthread_attr_t *attr, void **stackaddr, size_t *stacksize)
extern:003D8520                 IMPORT __imp_pthread_attr_getstack
extern:003D8520                                         ; CODE XREF: pthread_attr_getstack+8↑j
extern:003D8520                                         ; DATA XREF: .got:pthread_attr_getstack_ptr↑o

And if I double click pthread_attr_getstack+8↑j, it will go to the above .plt entry, and if I double click .got:pthread_attr_getstack_ptr↑o, it will go to one .got entry:

.got:003ADD8C pthread_attr_getstack_ptr DCD __imp_pthread_attr_getstack
.got:003ADD8C                                         ; DATA XREF: pthread_attr_getstack+8↑r

And if I double click the pthread_attr_getstack+8↑r in the .got entry, it will go to the above .plt entry as well. Does this mean that there is no code calling pthread_attr_getstack? If the answer is no, then how to find out all of locations calling pthread_attr_getstack? By the way, this is the elf which is named libmono.so that I want to reverse.

One thing to emphasis, the libmono.so elf file is very liked to be encrypted, that is to say, there may be a lot of obfuscated code in libmono.so.

Improve this question
6
  • Have you tried hitting x to see cross references?
    – NirIzr
    Sep 25, 2018 at 9:52
  • yes, I tried, no further progress had been made.
    – cong
    Sep 25, 2018 at 10:01
  • See that subroutine in graph mode.
    – Biswapriyo
    Sep 25, 2018 at 12:19
  • @Biswapriyo, won't work.
    – cong
    Sep 26, 2018 at 3:36
  • Are you certain the binary actually uses the function?
    – NirIzr
    Sep 26, 2018 at 5:18

1 Answer 1

Reset to default
2

After downloading and reviewing the file you shared, I can certainly say the pthread_attr_getstack function is never used by the binary.

If you're still certain the function is used it could be the case that:

  1. The function is dynamically loaded. I've searched for any clear dynamic loading using the dlsym function but I could've missed something (or there could be something more elaborate going on.
  2. The function could be used through another binary that is by itself used by your binary.

In any case, for multiple reasons presence in the import table does not necessarily imply the function is being used by the binary.

Improve this answer
1
  • I tried with readelf -Ds libmono.so | grep pthread_attr_getstack, the output is: 583 778: 00000000 0 FUNC GLOBAL DEFAULT UND pthread_attr_getstack, does this mean that pthread_attr_getstack is used in this binary file? And one thing to emphasis, the libmono.so binray file is very liked to be encrypted, that is to say, there may be a lot of obfuscated code in libmono.so binary file.
    – cong
    Sep 27, 2018 at 1:57

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.