0

I have a stripped-down Linux-based embedded system where a closed-source program(32-bit ELF binary for MIPS) depends on several shared libraries. Two of those libraries are actually the same libcurl library, but compiled differently. I need to know which one the program is actually using.

I can't install anything on that embedded system and the file system is read-only. Fortunately, there is a gdb available. When I execute the program and attach to it with gdb and print the loaded shared libraries with info sharedlibrary, then both libraries seem to be loaded:

(gdb) info sharedlibrary
From        To          Syms Read   Shared Object Library
/* output removed for brevity */
0x28c6a8b0  0x28caf770  Yes         /usr/lib//libcurl-jke.so.1
0x28d81150  0x28d86260  Yes         /usr/lib//libcurl-kkw.so.3
/* output removed for brevity */

Also, when I check the functions or variables with info functions or info variables, then I see items from libcurl under Non-debugging symbols. However, I don't know if those are from libcurl-jke.so.1 or from libcurl-kkw.so.3.

When I step through the program the debugger never shows that those libraries are used, but I know that they are because I see a HTTP GET request from this embedded system. What might cause this? Is there a way to see all the functions the program executes and files where those functions originate from using gdb?

Also, I could download this program and analyze it with radare2 if this helps.

1

ELF model doesn’t bind symbols to a specific library, so the first module providing a specific symbol is used. You can try to check into which address range the symbol’s value falls.

Note, however, that at the beginning most symbols point into the executable’s PLT (program linkage table) so you might need to wait until they’re actually called to get the resolved addresses. Another option is to put a breakpoint on a symbol and then step into it to see what library you end up in.

| improve this answer | |
  • Thanks! Did you mean if the curl related functions addresses(seen in the first column of the info functions command) fall into range of 0x28c6a8b0 - 0x28caf770 then they are from libcurl-jke.so.1 library or if they fall into range of 0x28d81150 - 0x28d86260, then they are from libcurl-kkw.so.3? – Martin May 3 at 16:45
  • @Martin yes, unless the address is in the main binary (PLT), then you’ll have to step through it to get to the actual library. – Igor Skochinsky May 3 at 16:47

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.