Find the C++ STL functions in a binary

Question

I have a binary file (actually, an operating system for an ARM embedded device which also contains some high-level apps (hard coded in the user interface)).

I know some parts of the operating system are from C++ code, so it is likely the binary contains the C++ STL.

However, I don't know much about the STL.

Would you have a method to find the address of the STL functions? (the basic method of searching for the "map", "vector", ... string was unsuccessful and I don't know any specific feature I could search for in this case)

Is there some kind of signature for the STL functions?

Thanks!

Additional informations: I use IDA. I can run the OS with a GDB. I know the address of much of the standard C functions (ctype/stddio/...).

Answer 1

Libraries like STL or Boost are tricky. Because they're heavily template-based and most of their code is generated at compile time, it's pretty difficult to make FLIRT-style signatures for them. Too much depends on the specific compiler, build options, optimization settings and so on, so unless you match them pretty closely when generating signatures, you're unlikely to get many good hits.

However, you may be able to find some signs of them. For example, the typical std::string implementation in some cases throws exceptions length_error or out_of_range. You might be able to find references to the error text or the exception names. Other than that I think there's not much you can look for besides recognizing a specific implementation from the actual code.

However, since you mention it's an RTOS, I highly doubt it's using STL. In an OS, any non-deterministic behavior is a bad thing, and with STL you can get an exception basically at any time. They may use some limited C++ for better encapsulation but any high-level classes are likely to be custom-made and not from STL or Boost.