Is it possible to find out all instances of static initialization in a elf dynamic library. I can dump the array of function pointers in .init_array section via objdump command like this. objdump -s -j .init_array <libname.so>

Is there a way to map these function pointers back to function names. I have unstripped library with debug symbols.

  • should be one liner in radare2. r2 -AA libname.so -qc "pxr @ sym..init_array"
    – sudhackar
    Mar 19 '19 at 8:10
  • Gave it some time and wrote this for i in `objdump -s -j .init_array libname.so | tail -n 1 | xxd -r | xxd -e -g 8 | tail -n 1 | grep -Eo "[0-9a-f]{16}"`; do nm libname.so | grep $i; done. It will break. Looks like this
    – sudhackar
    Mar 19 '19 at 8:24
  • @sudhackar the radare2 command above gives this error -" |ERROR| Invalid command 'pxr @ sym..init_array' (0x70)" Jul 3 '19 at 7:38
  • This is 3 months old, they might have changed the command. Let me check and confirm.
    – sudhackar
    Jul 3 '19 at 10:30

This can easily be achieved with radare2. I have this version installed

[rese] r2 -v
radare2 4.6.0-git 25072 @ linux-x86-64 git.4.4.0-486-ga5e8cf0c9
commit: a5e8cf0c9bd94e5f8d679e281c486584f23251e3 build: 2020-07-28__11:41:47

Enable .init_array in a program as such

#include <stdio.h>
static void f1(void) __attribute__((constructor));
static void f2(void) __attribute__((constructor));
static void f3(void) __attribute__((constructor));

void f1() { puts(__FILE__ ":f1"); }
void f2() { puts(__FILE__ ":f2"); }
void f3() { puts(__FILE__ ":f3"); }

int main(int argc, char **argv) {
    puts(__FILE__ ":main");
    return 0;

Which works as expected

[rese] make test
cc     test.c   -o test
[rese] ./test

Use the pxr to annotate while dumping as hex

[rese] r2 -AA -qq -c 'pxr 0x30 @ sym..init_array' test 
0x00200da0 0x0000000000000680   ........ @loc.__init_array_start 1664 (.text) sym.frame_dummy entry.init0 R X 'push rbp'
0x00200da8 0x000000000000068a   ........ 1674 (.text) sym.f1 sym.f1 R X 'push rbp'
0x00200db0 0x000000000000069d   ........ 1693 (.text) sym.f2 sym.f2 R X 'push rbp'
0x00200db8 0x00000000000006b0   ........ 1712 (.text) sym.f3 sym.f3 R X 'push rbp'
0x00200dc0 0x0000000000000640   @....... @loc.__init_array_end 1600 (.text) sym.__do_global_dtors_aux sym.__do_global_dtors_aux R X 'cmp byte [rip + 0x2009c9], 0'
0x00200dc8 0x0000000000000001   ........ @obj._DYNAMIC 0 loc.imp._ITM_deregisterTMCloneTable R X 'jg 0x47'

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.