Is it possible to find out all instances of static initialization in a elf dynamic library. I can dump the array of function pointers in .init_array section via objdump command like this. objdump -s -j .init_array <libname.so>

Is there a way to map these function pointers back to function names. I have unstripped library with debug symbols.

  • should be one liner in radare2. r2 -AA libname.so -qc "pxr @ sym..init_array" – sudhackar Mar 19 '19 at 8:10
  • Gave it some time and wrote this for i in `objdump -s -j .init_array libname.so | tail -n 1 | xxd -r | xxd -e -g 8 | tail -n 1 | grep -Eo "[0-9a-f]{16}"`; do nm libname.so | grep $i; done. It will break. Looks like this – sudhackar Mar 19 '19 at 8:24
  • @sudhackar the radare2 command above gives this error -" |ERROR| Invalid command 'pxr @ sym..init_array' (0x70)" – Arpit Aggarwal Jul 3 '19 at 7:38
  • This is 3 months old, they might have changed the command. Let me check and confirm. – sudhackar Jul 3 '19 at 10:30

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.