5

I have a binary file (actually, an operating system for an ARM embedded device which also contains some high-level apps (hard coded in the user interface)).

I know some parts of the operating system are from C++ code, so it is likely the binary contains the C++ STL.

However, I don't know much about the STL.

Would you have a method to find the address of the STL functions? (the basic method of searching for the "map", "vector", ... string was unsuccessful and I don't know any specific feature I could search for in this case)

Is there some kind of signature for the STL functions?

Thanks!

Additional informations: I use IDA. I can run the OS with a GDB. I know the address of much of the standard C functions (ctype/stddio/...).

3
  • 1
    What is the operating system? Why do you think it uses C++ (as opposed to plain C), and even if so, why do you think it uses STL?
    – Igor Skochinsky
    Mar 17, 2014 at 16:53
  • @JasonGeffner : IDA always do this when I disassemble x86 executables. In this case (is it because it is ARM? I don't know.), IDA did not find any standard function.
    – m4524t
    Mar 17, 2014 at 17:10
  • @IgorSkochinsky : The operating system is a proprietary operating system (based on Nucleus OS). I'd like to, but I cannot give you the name. It uses C++ as there are some C++ structures left as debug strings. I have no idea if it really use STL, but if it does not, I'd like to be sure about it.
    – m4524t
    Mar 17, 2014 at 17:13

1 Answer 1

7

Libraries like STL or Boost are tricky. Because they're heavily template-based and most of their code is generated at compile time, it's pretty difficult to make FLIRT-style signatures for them. Too much depends on the specific compiler, build options, optimization settings and so on, so unless you match them pretty closely when generating signatures, you're unlikely to get many good hits.

However, you may be able to find some signs of them. For example, the typical std::string implementation in some cases throws exceptions length_error or out_of_range. You might be able to find references to the error text or the exception names. Other than that I think there's not much you can look for besides recognizing a specific implementation from the actual code.

However, since you mention it's an RTOS, I highly doubt it's using STL. In an OS, any non-deterministic behavior is a bad thing, and with STL you can get an exception basically at any time. They may use some limited C++ for better encapsulation but any high-level classes are likely to be custom-made and not from STL or Boost.

5
  • Maybe I should have been more clear about it. Since it is on an embedded device, the OS also includes the whole user interface and some kind of "apps" hard-coded in the user-interface. The low-level of the OS is in C/assembly.
    – m4524t
    Mar 17, 2014 at 17:51
  • Well, okay, in that case it's plausible that the UI part is done in C++. But that's still not a sure guarantee it's using STL.
    – Igor Skochinsky
    Mar 17, 2014 at 21:44
  • Yeah, from the little I know of embedded development, they rarely use templates, and if they do use/have an STL, it is likely to be a cut-down/optimized one (i.e not your standard g++ STL).
    – fileoffset
    Mar 18, 2014 at 5:08
  • The other thing that makes this difficult, is that a lot of STL/template code are generated inline, so there aren't even any function calls to label...
    – fileoffset
    Mar 18, 2014 at 5:10
  • I tried to search for strings related to the two exceptions you gave. None of these have to do with STL. Thus, you are surely right. There is probably no "standard" STL (or it might be a version without any specific function). Thanks to all of you!
    – m4524t
    Mar 19, 2014 at 12:29

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.