0

I'm trying to search with IDA pro constants of type "#define SIZE 100" and normal local variables from a gcc-compiled binary file. I know there are a lot of open threads on the subject but I can't quite figure it out. For example, this tutorial is very close to what I want, but I don't understand how I can display them graphically in IDA pro. I'm new at this, thanks.

1

Generally speaking, this is not possible with any reverse engineering tool. If the programmer created custom #define statements to associate numbers with symbolic names, this information will be destroyed by the compiler very early into the compilation process, long before the binary is ultimately created. Local variable names are also not preserved in the final binary, unless the binary contains debug information (or you have external debug information that you can apply to the binary). However, if this were the case, IDA would have already applied the information, and you would already see the proper names.

TL;DR compilation destroys all symbolic names, and generally speaking, they cannot be recovered without debug information.

3
  • I compile with the following options: gcc -Og main.c -o main -no-pie -fno-guess-branch-probability The contents of the int constants are not shown to me, but the "#define msn "Hello" constants are shown in .rdata. But my program only has integer constants / literals. Of the variables I can only describe that I can find them in the form "var_XXX" and I can't know the name of the variable, is it true? – Michael Oct 16 '20 at 8:03
  • 1
    Compilation destroys the names of everything: #defines, const literals, function names, local/global variable names, goto label names, structure names, structure field names, typedef names, module names, enum element names. The only time you'll see a name from the original source code in a binary is if it's an imported or exported name (a function or data item), or if the binary was compiled with debug information/RTTI, as described in my answer. – Rolf Rolles Oct 16 '20 at 8:31
  • What would be the best way to compile with debugging information? I would have to do it this way: gcc -g -Wall -o main_es main_es.c – Michael Oct 16 '20 at 8:35

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.