I'm trying to analyze a GCC static library which is a part of a commercial software.
First, I used
IDA Pro to analyze entire Lib file, but it could find only object files and was unable to disassemble objects.
So, I extracted all of the inside objects by
ar -x. Next, I used
binwalk, It shows multiple
Zlib Compressed regions next to the 64-bytes header (EFI x64). Is this ordinary in static libraries (existence of several zlib region)? Is it a protection method?
Anyway, I used
zlib-flate -uncompress to extract sections in one of the objects after separating its zlib regions (by
dd), and used
IDA Pro to disassemble the output. Although, some of the sections contain some valid strings (Unix Path),
IDA Pro shows invalid codes.
Thanks in advance.