2


This is a code to call an external function(get_random_name) in the main function

push {fp, lr}
add fp, sp, 4
sub sp, sp, 0x1d8
str r0, [fp, -0x1d8]     
str r1, [fp, -0x1dc]      
sub r3, fp, 0x44
mov r0, r3
bl sym.imp.get_random_name
... ...

If I go to the function get_random_name,

;-- get_random_name:
add ip, pc, 0, 12
add ip, ip, 8, 20
ldr pc, [ip, 0x9b0]!

I think this is not a real code of get_random_name.
How can I find this function code correctly?
Should I search this code on the other files or libraries? I am using Ghidra & radare2 now.

5

The second piece of code is a so-called PLT (program linkage table) thunk. It retrieves the pointer to the target function from the GOT (Global offset table) and jumps to it. The GOT pointer is usually filled in by the dynamic loader (ld.so or an analog) at the program's startup. So indeed, the real function should be in one of the dependent shared libraries.

2
  • Thank you. I will find in the dependent shared libraries. – three2zero Jun 2 at 14:41
  • Can't you please explain how can I analyze the dynamic loader file(*.so) to find the external function code? – three2zero Jun 2 at 14:54

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.