Sometimes I'm doing static analysis outside of the debugger, and I want to see what a function that a symbol points to will do after the linker does runtime relocation. All I see in the disassembly is the call to sym.imp.puts in the PLT, and if I follow it I only see the call to reloc.puts in the GOT.

Is there anyway Radare can integrate with the linker to do this without running it in the debugger?

I would like to do something like

pdf @ sym.imp.puts

Without having to run the binary in a debugger, or doing static analysis myself manually on the external library.

  • This sounds like a feature request so probably better addressed by r2 developers – Igor Skochinsky Nov 11 at 11:07

Your Answer

 

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Browse other questions tagged or ask your own question.