0

I am reverse engineering a Windows application for which there is no PDB file available. When loading it in r2, I get the following imports (They are correct):

 nth  vaddr      bind type lib          name
―――――――――――――――――――――――――――――――――――――――――――
545  0x00012008 NONE FUNC COREDLL.dll  Ordinal_545
557  0x0001200c NONE FUNC COREDLL.dll  Ordinal_557

Stub functions are called in the disassembly, like this

bl fcn.000111c8

and fcn.000111c8 essentially loads the address and calls the actual function

┌ 12: fcn.000111c8 ();                                                          
│           0x000111c8           ldr ip, sym.imp.COREDLL.dll_Ordinal_545
│           0x000111cc           ldr ip, [ip]               
└           0x000111d0           bx ip 

I have the COREDLL.dll file and it contains correct debug symbols. I would like to tell r2 to use them to get the function names for these plt entries, so that I see the real function names from the DLLs instead of generated names like "Ordinal_xxx".

How do I do that?

0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Browse other questions tagged or ask your own question.