Is there a practical way to find if the raw binary (firmware image for example) has symbol table ? Finding start or end of it ? And if it exists is it a single block or can it be seperate multiple blocks with another data inbetween ?
I worked with some types of symbol tables. All these types are very different and can not be defined as something that allows automatic detection. It can be some kind of list of tuples like (pointer to name, type, pointer to object, [something else]). There are a lot of other variants also. Any time I succeeded to recognize symbol table it was done by manual inspection of analyzed dump.
My methodology to find such symbol table is as follows (assuming that IDA didn't find it automatically):
1 - Find all strings in the binary, sort them and inspect results. If you see a lot of potential object names (function names, global variable names etc) you can suspect that you can use it and it is possible that there is symbol table in the binary.
2 - Choose some strings from the set. Check references to them. If you find these references in something that looks like array of structures or any other regular data structure it might be your symbol table.
3 - When you understand what is the structure of your symbol table you can rename your objects with simple IDAPython script.
As pointed out in the first comment: firmware may have a custom format, therefore there is no general way to extract the symbols table from it. However,
you can extract the debugging symbols from an ELF binary using
objcopy. The command should look something like:
objcopy --only-keep-debug binary_file output_file_with_debug_symbols
If you inspect the
output_file_with_debug_symbols you will see which were the symbols from your binary. This is how to find out if an ELF binary has a symbol table.
By using dhex to compare the binary_file and the output_file_with_debug_symbols you can see that the isn't a fixed place in the binary where the debugging symbols start. However, in my case most of the debugging symbols were at the end of the binary.
It also seems that the debugging symbols are not a continuous block. There exist some short byte sequences at seemingly random positions, which are different in the binary file and the debug symbols file. Therefore, I don't think you can extract the symbols by simply start from an index and copy each byte until some ending index in the binary.