3

Is there a practical way to find if the raw binary (firmware image for example) has symbol table ? Finding start or end of it ? And if it exists is it a single block or can it be seperate multiple blocks with another data inbetween ?

Improve this question
4
  • 4
    This is so incredibly vague, I don't see how it can possibly answered. At a minimum a symbol is just a (name, address) pair, which could be stored in any number of formats in a binary.
    – Jonathon Reinhart
    Jan 21, 2014 at 3:22
  • The only practical way to find symbol table is to look to strings in the binary and their addresses. You can use linux strings utility for this if you don't have IDA.
    – w s
    Jan 21, 2014 at 6:46
  • So a symbol table is always a name-address pair ? What seperates them usually ? What strings have to be there if it is not stripped ? Any helpful tips to recognize it if header is missing ?
    – user3155036
    Jan 21, 2014 at 11:08
  • Which file do you working with? Do you see function names in its strings ?
    – w s
    Jan 21, 2014 at 12:19

2 Answers 2

Reset to default
4

I worked with some types of symbol tables. All these types are very different and can not be defined as something that allows automatic detection. It can be some kind of list of tuples like (pointer to name, type, pointer to object, [something else]). There are a lot of other variants also. Any time I succeeded to recognize symbol table it was done by manual inspection of analyzed dump.

My methodology to find such symbol table is as follows (assuming that IDA didn't find it automatically):

1 - Find all strings in the binary, sort them and inspect results. If you see a lot of potential object names (function names, global variable names etc) you can suspect that you can use it and it is possible that there is symbol table in the binary.

2 - Choose some strings from the set. Check references to them. If you find these references in something that looks like array of structures or any other regular data structure it might be your symbol table.

3 - When you understand what is the structure of your symbol table you can rename your objects with simple IDAPython script.

Improve this answer
3
  • 1
    Number 2 should mention that the references may also be in the vicinity of the string. E.g. a few bytes before. Or that the same may hold for a pointer to the string. Still +1
    – 0xC0000022L ♦
    Jan 22, 2014 at 11:36
  • OK as I try to make same thing mostly but can it be there are more than one symbol tables ? I mean in binaries you can find references to function names and function start addresses but those blocks end and somewhere else it starts again. Can such a symbol table be legit ? I dont mean any particular system but custom format binaries which are not in ELF format generally.
    – user3155036
    Jan 22, 2014 at 13:08
  • Yes.Such symbol table can be legit.
    – w s
    Jan 22, 2014 at 13:16
2

As pointed out in the first comment: firmware may have a custom format, therefore there is no general way to extract the symbols table from it. However, you can extract the debugging symbols from an ELF binary using objcopy. The command should look something like:

objcopy --only-keep-debug binary_file output_file_with_debug_symbols

If you inspect the output_file_with_debug_symbols you will see which were the symbols from your binary. This is how to find out if an ELF binary has a symbol table.

By using dhex to compare the binary_file and the output_file_with_debug_symbols you can see that the isn't a fixed place in the binary where the debugging symbols start. However, in my case most of the debugging symbols were at the end of the binary.

It also seems that the debugging symbols are not a continuous block. There exist some short byte sequences at seemingly random positions, which are different in the binary file and the debug symbols file. Therefore, I don't think you can extract the symbols by simply start from an index and copy each byte until some ending index in the binary.

Improve this answer
3
  • IDA would recognize such symbols automatically(objcopy is for ELF which is handled well in IDA). If it is firmware it can be in custom format with its own custom symbol table.
    – w s
    Jan 21, 2014 at 16:23
  • @ws that's true, but the title of the question refers to binaries in general. Firmware is mentioned "for example". However, I will edit my answer to clarify things. I just gave the answer for ELF binaries as you pointed out.
    – Benny
    Jan 21, 2014 at 16:35
  • @ws: what objcopy is for is defined at compile time. On a Ubuntu 10.04: objcopy: supported targets: elf64-x86-64 elf32-i386 a.out-i386-linux pei-i386 pei-x86-64 elf64-l1om elf64-little elf64-big elf32-little elf32-big plugin srec symbolsrec verilog tekhex binary ihex
    – 0xC0000022L ♦
    Jan 22, 2014 at 11:34

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.