1

I have two versions of an app: one version compiled for ARM64 iOS, and the other for ARM32 Android. I'm working on the ARM64 version, but it has almost all of its symbols stripped. The ARM32 version is not stripped at all, so has all of the symbol names left intact.

Up to now I have been using two Binary Ninja tabs for each version of the game, and have found symbol names for the ARM64 version by finding the same function in the ARM32 tab and then transferring symbol names that I see. However, this is slow and annoying, so I've started looking for a possible way of matching up symbols by comparing the binaries. This sounds like a difficult problem to solve, and I would settle for even a partial job (such as a tool that only transfers things that it is certain about, which leaves me to decipher some of the more complicated parts).

I think I'm being a bit hopeful here, but I figured it was worth asking just in case somebody has done this before.

1

Ghidra has a version tracking tool with lots of analysis options to compare features of the binaries to name things. I have used it on ppc->mips firmware. I started off with a pretty RE'ed PPC image and a new MIPS firmware with the default tool in ghidra, I named a handful of functions in the new one. Opening them up in the version tracker tool, I tried one of the analysis options, "exact symbol match" and it picked up quite a few additional functions to be named, which it then builds upon to name more and more. Adding more analysis options should give more/better results, would just take whatever amount time depending on the binaries.

1
  • Thank you! This is exactly the sort of thing I was looking for. I've run it through a few times now, and it has done a great job.
    – squ1dd13
    May 8 at 15:33
1

I think Diaphora supports cross architecture binary diffing so that could be an additional option to try.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.