I'm trying to search with IDA pro constants of type "#define SIZE 100" and normal local variables from a gcc-compiled binary file. I know there are a lot of open threads on the subject but I can't quite figure it out. For example, this tutorial is very close to what I want, but I don't understand how I can display them graphically in IDA pro. I'm new at this, thanks.
Generally speaking, this is not possible with any reverse engineering tool. If the programmer created custom
#define statements to associate numbers with symbolic names, this information will be destroyed by the compiler very early into the compilation process, long before the binary is ultimately created. Local variable names are also not preserved in the final binary, unless the binary contains debug information (or you have external debug information that you can apply to the binary). However, if this were the case, IDA would have already applied the information, and you would already see the proper names.
TL;DR compilation destroys all symbolic names, and generally speaking, they cannot be recovered without debug information.
I compile with the following options:
gcc -Og main.c -o main -no-pie -fno-guess-branch-probabilityThe contents of the int constants are not shown to me, but the "#define msn "Hello" constants are shown in .rdata. But my program only has integer constants / literals. Of the variables I can only describe that I can find them in the form "var_XXX" and I can't know the name of the variable, is it true?– MichaelOct 16, 2020 at 8:03
1Compilation destroys the names of everything:
constliterals, function names, local/global variable names,
gotolabel names, structure names, structure field names,
typedefnames, module names,
enumelement names. The only time you'll see a name from the original source code in a binary is if it's an imported or exported name (a function or data item), or if the binary was compiled with debug information/RTTI, as described in my answer. Oct 16, 2020 at 8:31
What would be the best way to compile with debugging information? I would have to do it this way:
gcc -g -Wall -o main_es main_es.c– MichaelOct 16, 2020 at 8:35