4

There are some *.so libraries in my ELF file.
I can see the *.so names in "Imports" directory of "Symbol Tree" Window in Ghidra tool.
I think there are some external functions in the *.so libraries.
How can I decompile external functions of *.so libraries in ELF with Ghidra?

Improve this question
2
  • How do you see them in Ghidra? Do you mean that you have a call in your elf file to a function from another file? (imported function)
    – macro_controller
    Jun 3, 2021 at 11:20
  • @macro_controller, thanks for your comment. I edited my question again.
    – three2zero
    Jun 4, 2021 at 2:09

2 Answers 2

Reset to default
5

The cleanest way to do this is to click on Options when importing a file:

enter image description here

then activate Load External Libraries enter image description here

and make sure that the paths where the libraries are located appear in the list you can change with Edit Paths enter image description here

This will import all required libraries into Ghidra:

enter image description here

and resolve the external symbols to the providing library:

enter image description here

You can now (auto) analyze the libraries as you would any other binary, and clicking on the "thunked Function" enter image description here will open the library in which the function is defined in, in a new tab.

If you want to do it afterwards, you can still manually import the libraries and then link them via the context menu action Set External Program in the Symbol Tree (for the specific library), then run the FixupELFExternalSymbolsScript.java GhidraScript

Improve this answer
1

In order to do that, go to File->Add to Program... and pick this file from the file system. It will be added to ghidra. you might need to reanalyze the whole program. Afterward, you should find those functions in the function list and can view them in the decompile.

Improve this answer
6
  • thanks for your answer. When I try "Add to Program", I got an error in "Add to Program" dialog. Memory Conflict: Use <options...> to change the base address! I chose my elf file for add to program in the codebrowser windows, am I right?
    – three2zero
    Jun 4, 2021 at 13:19
  • You said, pick this file from the file system. I am not clear this. The file system is my OS and this file is my ELF file, right?
    – three2zero
    Jun 4, 2021 at 13:30
  • Try to load the file to another address. You have the other elf on your computer - you basically loading two elf files into the same memory space in Ghidra by doing this.
    – macro_controller
    Jun 4, 2021 at 14:33
  • @macro_controller i think the op is loading the same file as his target (loading foo.exe twice) not foo.exe and blah.so i think misunderstanding your ThisFile please clarify what your intent was
    – blabb
    Jun 4, 2021 at 18:36
  • 1
    Add to Program is a really hacky way to achieve something that Ghidra can do a lot more elegantly. I posted another answer describing that process, because I think this is what the OP actually is looking for
    – Florian Magin
    Jun 21, 2021 at 11:00

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.