I'm trying to reverse engineering a obfuscated game, and when I import this related .so file into IDA, it output this : enter image description here

What technique is most likely been used in achieving such obfuscation ?

  • 1
    please add the output of objdump -p, at least the part about the "program headers" of both the primary executable and the .so file to the question. PHT means "program header table" in this context. Sep 9 at 22:01

PHT means “program header table” and is one of the two tables describing the layout of the ELF file. The PHT is the one used by the OS to decide which parts of the file are mapped at what addresses in the memory.

The ELF specification does not specify what should happen if the segments in the PHT overlap, so the actual behavior depends on how the loader is implemented. If the OS behaves differently from IDA, you may see an incomplete picture, so it may be best to run it in debugger and see what actually ends up in the memory.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.