How to detect which shared libraries a binary is actually using?

Question

I have a stripped-down Linux-based embedded system where a closed-source program(32-bit ELF binary for MIPS) depends on several shared libraries. Two of those libraries are actually the same libcurl library, but compiled differently. I need to know which one the program is actually using.

I can't install anything on that embedded system and the file system is read-only. Fortunately, there is a gdb available. When I execute the program and attach to it with gdb and print the loaded shared libraries with info sharedlibrary, then both libraries seem to be loaded:

(gdb) info sharedlibrary
From        To          Syms Read   Shared Object Library
/* output removed for brevity */
0x28c6a8b0  0x28caf770  Yes         /usr/lib//libcurl-jke.so.1
0x28d81150  0x28d86260  Yes         /usr/lib//libcurl-kkw.so.3
/* output removed for brevity */

Also, when I check the functions or variables with info functions or info variables, then I see items from libcurl under Non-debugging symbols. However, I don't know if those are from libcurl-jke.so.1 or from libcurl-kkw.so.3.

When I step through the program the debugger never shows that those libraries are used, but I know that they are because I see a HTTP GET request from this embedded system. What might cause this? Is there a way to see all the functions the program executes and files where those functions originate from using gdb?

Also, I could download this program and analyze it with radare2 if this helps.

Answer 1

ELF model doesn’t bind symbols to a specific library, so the first module providing a specific symbol is used. You can try to check into which address range the symbol’s value falls.

Note, however, that at the beginning most symbols point into the executable’s PLT (program linkage table) so you might need to wait until they’re actually called to get the resolved addresses. Another option is to put a breakpoint on a symbol and then step into it to see what library you end up in.