0

I have a couple of questions about the Ghidra

  1. I am analyzing a binary file and in the binary it uses a functions from libstdc++. What is the best way to add the signatures of functions from "libstdc++" into my binary file ?

  2. I see in the "External program" window multiple so files, from where Ghidra takes this so files ?

Improve this question

1 Answer 1

Reset to default
1

  1. The easiest way is to get a build of libstdc++ with DWARF debug symbols e.g. by downloading it from the Debian repositories https://packages.debian.org/buster/libstdc++6-7-dbg. In general you can also compile it yourself, but for common libraries Debian tends to have a version built with debug symbols already. You can then auto analyse it (or run only the DWARF debug analyses), and export a GDT archive via "Capture Function Signatures", either as a file archive or project archive, and then load this in your desired binary and apply it.

  2. Ghidra searches some folders for libraries when a binary is imported, I already described the details in this answer (with screenshots)

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.