0

I have an executable of a (rather simple) GUI application on Linux, built in Qt5. I am able to run it, and want to find out what happens internally when I press one of the buttons. I suspect that the button might not just execute some code but run another executable, which has been packaged into the main one. I want to find out which code is being run, or extract the executable (if my assumption is true), both would be fine. I know roughly what function name to look for, since I can sort of guess it from what the button does and it's tooltip.

The ultimate goal is to isolate the functionality of the button to be able to run it on the terminal.

I am new to reverse engineering, please excuse if anything I write is wrong or trivial. So far I have found this and this question which are kind of related and use objdump and readelf, but so far I had no luck with those.

Improve this question
4
  • There are a lot of disassembled/decompilers that are very good; some for free, some for a price. Are you using one of those? – multithr3at3d May 9 '20 at 20:26
  • Nope, so far I have tried objdump and readelf commands and the debugger of Qt Studio. Which (free) one would you suggest? – olex May 10 '20 at 10:08
  • I suggest to use IDA Freeware, IDA Home. I suggest using IDA Freeware, IDA Home. As a free (and opensource) alternative, you can try Ghidra, but I personally don't like it. – progopis May 10 '20 at 11:35
  • There's also Binary Ninja Cloud and the Retargetable Decompiler. – multithr3at3d May 10 '20 at 21:38
2

I recommend to use IDA for this task but you can try something other. There are dozens of disassemblers.

Open your app in the disassebmler, locate something like that:

Method names of the MainWindow

Scroll up and find XRef with 'qt_metacast(char const*)' (in case the binary is not stripped):

.rodata:00069B90 aMainwindow_0   db 'MainWindow',0       ; DATA XREF: MainWindow::qt_metacast(char const*)+18↑o

Open the class method by click to this XREF or with Ctrl+X hotkey.

You will see 'MainWindow::qt_metacast' method but you need 'MainWindow::qt_metacall' now. Inside of the 'MainWindow::qt_metacall' you will see 'MainWindow::qt_static_metacall' call. Inside it will be a big switch with real slots called when buttons are clicked (more generally: not only buttons and not only clicks).

Inside of the MainWindow::qt_static_metacall

As it's easy to notice, the necessary names already have the correct names, but in the more complicated case, when the binary is stripped, it will be necessary to restore the names from the table of method names. The number in the switch corresponds to the row index with the method name in the method table with some exceptions (refer to the Qt5 sources please)

An example of some additional strings located in the same table of methods that are not slots:

enter image description here

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.