I have two kinds of ELF files, built from C++.

.so files:

ELF 64-bit LSB shared object, x86-64, version 1 (GNU/Linux), dynamically linked, BuildID[sha1]=5e751e769912aef28bc63b888e5e4904b867a180, stripped

And executables:

ELF 64-bit LSB executable, x86-64, version 1 (SYSV), dynamically linked, interpreter /lib64/ld-linux-x86-64.so.2, for GNU/Linux 2.6.32, BuildID[sha1]=1c215d8895277612d3f4332836f48dd45967f69d, stripped

I am completely new to reverse engineering, and I have been experimenting with objdump, readelf and nm, but I still need some help.

I want to find function calls to a few functions from a library, without executing the binaries (i.e., static analysis).

With the above commands, I know the symbols are used, but I do not know which arguments are passed to the calls, or how many times the function was called.

Ideally, I would like to get something close to the original source code, e.g.

thelib::TheClass::theFunction("a", b, c);

but I understand this is hard to achieve. I would be content just by retrieving whether the first argument was a string literal (and its value) or something else.

Is this possible with existing tools, such as the above (possibly with specific options), or would I have to implement something of my own?

  • 1
    Welcome to RE.SE! There are a lot of Disassemblers out there which may aid you with your task. I would recommend familiarizing yourself with IDA (7.0 is free), binaryninja, radare2, hopper or something similar. Basically, you would need some dataflow analysis to see which data does where. – Nordwald Feb 26 at 16:16
  • @Nordwald: Isn't IDA Free limited to PE files? – 0xC0000022L Feb 26 at 16:24

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.