I have an ELF 32-bit binary and it is a stripped binary.
Yet, when I load with IDA Pro, I can see the function names like write, open, malloc and so on. So, I am trying to understand if the binary is stripped, then why am I still able to see these function names?
Output of file command for the binary:
ELF 32-bit LSB executable, Intel 80386, version 1 (SYSV), dynamically linked (uses shared libs), stripped
Example of a code section from the binary:
.text:080485D0 push offset asome_string ; "[ some string ]\n" .text:080485D5 call sub_80483F0 .text:080483F0 buf = dword ptr 4 .text:080483F0 .text:080483F0 sub esp, 0Ch .text:080483F3 sub esp, 4 .text:080483F6 sub esp, 8 .text:080483F9 push [esp+18h+buf] .text:080483FD call sub_8049EA0 .text:08048402 add esp, 0Ch .text:08048405 push eax ; n .text:08048406 push [esp+14h+buf] ; buf .text:0804840A push 1 ; fd .text:0804840C call _write .text:08048411 add esp, 10h .text:08048414 add esp, 0Ch .text:08048417 retn
In the above code section, sub_80483F0 is a subroutine which takes one argument. This subroutine will then call sub_8049EA0 to calculate the length of the buffer and then write the buffer to stdout.
So, _write is a symbol which was resolved by IDA Pro.
How did IDA Pro resolve _write?
I can see the _write is defined inside the .plt section of the ELF as shown below:
.plt:08048330 _write proc near ; CODE XREF: sub_80483F0+1Cp .plt:08048330 jmp ds:write_ptr .plt:08048330 _write endp
It has a jump stub which points to write_ptr
write_ptr is inside the .got.plt which I think will be populated with the correct value of the function pointer at runtime.
But the question is, if the binary is stripped then shouldn't it have prevented IDA Pro from displaying the function name, _write in the first place?