I have a stripped-down Linux-based embedded system where a closed-source program(32-bit
ELF binary for MIPS) depends on several shared libraries. Two of those libraries are actually the same
libcurl library, but compiled differently. I need to know which one the program is actually using.
I can't install anything on that embedded system and the file system is read-only. Fortunately, there is a
gdb available. When I execute the program and attach to it with
gdb and print the loaded shared libraries with
info sharedlibrary, then both libraries seem to be loaded:
(gdb) info sharedlibrary From To Syms Read Shared Object Library /* output removed for brevity */ 0x28c6a8b0 0x28caf770 Yes /usr/lib//libcurl-jke.so.1 0x28d81150 0x28d86260 Yes /usr/lib//libcurl-kkw.so.3 /* output removed for brevity */
Also, when I check the functions or variables with
info functions or
info variables, then I see items from
Non-debugging symbols. However, I don't know if those are from
libcurl-jke.so.1 or from
step through the program the debugger never shows that those libraries are used, but I know that they are because I see a HTTP GET request from this embedded system. What might cause this? Is there a way to see all the functions the program executes and files where those functions originate from using
Also, I could download this program and analyze it with
radare2 if this helps.