I have a packed Linux shared library that decrypts function stub with INIT_ARRAY.
When it's decrypted I'm unable to determine the method name. All method calls are redirected with relocation table. Something similar to this:
push 34h
jmp _dl_runtime_resolve_xsavec
How can I figure out the real address it's calling?
_dl_runtime_resolve looks like a typical name for the dynamic symbols lookup function in the dynamic loader (ld.so). The argument is usually a reference to the symbol being resolved in the dynamic symbol table. It can be either an index, or a raw offset (index multiplied by symbol entry size).
In “normal” binaries the dynamic symbols reside in the .dynsym section, but it is not actually enforced by the loader. It actually uses the DT_DYNSYM/DT_STRTAB entries from the dynamic table (PT_DYNAMIC segment type). Since your binary is packed, it could be obfuscated even further and use the pointer to the dynamic table from the first entry of the GOT.
If you can debug the binary, it may be easier to step through the resolver code and see how it decides which symbol to resolve than trying to deduce it statically.
