IDA Pro is showing Function names for a Stripped Binary

Question

I have an ELF 32-bit binary and it is a stripped binary.

Yet, when I load with IDA Pro, I can see the function names like write, open, malloc and so on. So, I am trying to understand if the binary is stripped, then why am I still able to see these function names?

Output of file command for the binary:

ELF 32-bit LSB  executable, Intel 80386, version 1 (SYSV), dynamically linked (uses shared libs), stripped

Example of a code section from the binary:

.text:080485D0                 push    offset asome_string ; "[ some string ]\n"
.text:080485D5                 call    sub_80483F0


.text:080483F0 buf             = dword ptr  4
.text:080483F0
.text:080483F0                 sub     esp, 0Ch
.text:080483F3                 sub     esp, 4
.text:080483F6                 sub     esp, 8
.text:080483F9                 push    [esp+18h+buf]
.text:080483FD                 call    sub_8049EA0
.text:08048402                 add     esp, 0Ch
.text:08048405                 push    eax             ; n
.text:08048406                 push    [esp+14h+buf]   ; buf
.text:0804840A                 push    1               ; fd
.text:0804840C                 call    _write
.text:08048411                 add     esp, 10h
.text:08048414                 add     esp, 0Ch
.text:08048417                 retn

In the above code section, sub_80483F0 is a subroutine which takes one argument. This subroutine will then call sub_8049EA0 to calculate the length of the buffer and then write the buffer to stdout.

So, _write is a symbol which was resolved by IDA Pro.

How did IDA Pro resolve _write?

I can see the _write is defined inside the .plt section of the ELF as shown below:

.plt:08048330 _write          proc near               ; CODE XREF: sub_80483F0+1Cp
.plt:08048330                 jmp     ds:write_ptr
.plt:08048330 _write          endp

It has a jump stub which points to write_ptr

write_ptr is inside the .got.plt which I think will be populated with the correct value of the function pointer at runtime.

But the question is, if the binary is stripped then shouldn't it have prevented IDA Pro from displaying the function name, _write in the first place?

Thanks.

Answer 1

write is a function that is imported from one of your system modules. Because it has to be imported, the name should be available in your binary, and ida uses this to automatically name the stub that calls the function.

As a little experiment, try: objdump -T yourfile, and you should see something like the following (from a dummy x64 binary):

objdump -T test

test:     file format elf64-x86-64

DYNAMIC SYMBOL TABLE:
0000000000000000      DF *UND*  0000000000000000  GLIBC_2.2.5 write
0000000000000000      DF *UND*  0000000000000000  GLIBC_2.2.5     __libc_start_main
0000000000000000  w   D  *UND*  0000000000000000              __gmon_start__

Or even simpler: strings yourfile