0

I have some compiled code and would like to use Cutter (Radare2) to find the place where a certain static string is printed out. The code is an object file, compiled for ARM, and to be included with the Linux kernel. It is not a full executable or module.

$ file mybinary
mybinary: ELF 32-bit LSB relocatable, ARM, EABI5 version 1 (SYSV), not stripped

When I load the file in Cutter, I can see some functions, but they do not seem relevant, and I can see the string I am looking for. However, if I try to find Xrefs for the string, I don't find anything.

I do find addresses in the disassembly that look similar to addresses in data, e.g. they both end with the same digits but have an offset. This makes me think you have to specify an offset, especially since this is a relocatable object? Maybe you have to specify the map offset (-m)? How to know this value?

Here is a similar question, but the poster seemed to have a problem with their installation. Also I have only an object file, where they had an executable, so I the issue of relocation is relevant in my case: Find reference to string in radare2

  • can you share the binary and mention which string you want to check? in radare2 it is as easy as executing izz~<string> to list all strings and grep for <string> and then get the address. Then, do axt <string_offset> to see where the address is referenced from. In cutter, you go to the Strings widget, search for your string (ctrl+f), double click it an press X. – Megabeets Nov 27 '18 at 12:46
  • @Megabeets Yes, this is what I tried, I find the string, but it is not referenced from anywhere. I believe this is because I have an unlinked object file, and the addresses are not correct. – jdm Nov 27 '18 at 12:54
  • Many reasons might cause this, but as much as we want to help - it's hard for us to play guessing since we can't see the actual binary. If you can't share the binary, maybe more information would help us – Megabeets Nov 27 '18 at 12:55
  • @Megabeets Well, first of all, can this work? Can you use Radare on an object file (as opposed to a linked executable)? Does Radare take relocation into account? I read that e.g. IDA Pro can patch up addresses in this case. It is my understanding that I have to perform one more step to deal with relocation, but I don't know what that step is. If I do this on an executable it works fine. Also, unfortunately, I cannot share the binary file. – jdm Nov 27 '18 at 13:00
  • both in r2 and Cutter, you can use -m to map the file to a specific offset, and -B to set the base address of a file. And yes, radare2 would work on object files as well. If you happen to have a similar file which you can share it would be even easier to demonstrate :) – Megabeets Nov 27 '18 at 13:03

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Browse other questions tagged or ask your own question.