0

Given C code, are the function addresses from the ELF the same as those in the stripped version?

I don't have any specific code in mind. Just trying to learn in general how to find the function beginning (and possibly end) in the stripped binary given the original code.

  • 1
    if you have c code you have line numbers and one lineof c code can correspond to several address also a debug version of code will and can have a completely different code sequence and from a releaseversion and as such can differ greatly please edit in relevent details your query as is kinda vague – blabb Jul 24 at 17:36
1

In a nutshell, stripping a binary means removing sections containing symbol and debug information from the file. These sections lie at the end of the binary, separate from the code. Removing this information has no bearing on the code itself, so the locations of functions in the file (their file offsets) will be the same after stripping the binary. Function addresses (their location in virtual memory), on the other hand, may either be hardcoded or position independent; it depends on how the binary was compiled (this is also unaffected by stripping symbol info).

Finding the boundaries of functions in stripped binaries is an undecidable problem, but workarounds and heuristics exist, such as a signature-based approach to function detection. Here are some examples:

  1. IDA FLIRT essentially uses byte patterns to create function signatures
  2. Ghidra's FunctionID feature takes mnemonic and operand type into account when hashing instructions to match functions to their well-known name
  3. JEB's disassembler creates function signatures by hashing the assembly (not binary code) of the function with a custom hashing algorithm.
  4. BinaryNinja's Signature Library

Here is an interesting article on the subject: Architecture Agnostic Function Detection in Binaries

| improve this answer | |
  • Thanks a bunch! I was worried that the address space of functions would change by converting the ELF to a stripped binary. – Steven Jul 25 at 5:08
  • @Steven no conversion takes place. Stripping merely removes information from the file that isnt used during execution anyway – julian Jul 25 at 5:11

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.