0

I'm trying to search with IDA pro constants of type "#define SIZE 100" and normal local variables from a gcc-compiled binary file. I know there are a lot of open threads on the subject but I can't quite figure it out. For example, this tutorial is very close to what I want, but I don't understand how I can display them graphically in IDA pro. I'm new at this, thanks.

Improve this question

1 Answer 1

Reset to default
1

Generally speaking, this is not possible with any reverse engineering tool. If the programmer created custom #define statements to associate numbers with symbolic names, this information will be destroyed by the compiler very early into the compilation process, long before the binary is ultimately created. Local variable names are also not preserved in the final binary, unless the binary contains debug information (or you have external debug information that you can apply to the binary). However, if this were the case, IDA would have already applied the information, and you would already see the proper names.

TL;DR compilation destroys all symbolic names, and generally speaking, they cannot be recovered without debug information.

Improve this answer
3
  • I compile with the following options: gcc -Og main.c -o main -no-pie -fno-guess-branch-probability The contents of the int constants are not shown to me, but the "#define msn "Hello" constants are shown in .rdata. But my program only has integer constants / literals. Of the variables I can only describe that I can find them in the form "var_XXX" and I can't know the name of the variable, is it true?
    – Michael
    Oct 16, 2020 at 8:03
  • 1
    Compilation destroys the names of everything: #defines, const literals, function names, local/global variable names, goto label names, structure names, structure field names, typedef names, module names, enum element names. The only time you'll see a name from the original source code in a binary is if it's an imported or exported name (a function or data item), or if the binary was compiled with debug information/RTTI, as described in my answer.
    – Rolf Rolles
    Oct 16, 2020 at 8:31
  • What would be the best way to compile with debugging information? I would have to do it this way: gcc -g -Wall -o main_es main_es.c
    – Michael
    Oct 16, 2020 at 8:35

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.