2


This is a code to call an external function(get_random_name) in the main function

push {fp, lr}
add fp, sp, 4
sub sp, sp, 0x1d8
str r0, [fp, -0x1d8]     
str r1, [fp, -0x1dc]      
sub r3, fp, 0x44
mov r0, r3
bl sym.imp.get_random_name
... ...

If I go to the function get_random_name,

;-- get_random_name:
add ip, pc, 0, 12
add ip, ip, 8, 20
ldr pc, [ip, 0x9b0]!

I think this is not a real code of get_random_name.
How can I find this function code correctly?
Should I search this code on the other files or libraries? I am using Ghidra & radare2 now.

1 Answer 1

5

The second piece of code is a so-called PLT (program linkage table) thunk. It retrieves the pointer to the target function from the GOT (Global offset table) and jumps to it. The GOT pointer is usually filled in by the dynamic loader (ld.so or an analog) at the program's startup. So indeed, the real function should be in one of the dependent shared libraries.

2
  • Thank you. I will find in the dependent shared libraries.
    – three2zero
    Jun 2, 2021 at 14:41
  • Can't you please explain how can I analyze the dynamic loader file(*.so) to find the external function code?
    – three2zero
    Jun 2, 2021 at 14:54

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.