5

I would like to load a function I have decompiled in IDA Pro. All I have is the IDA Pro function name sub_xxxx() and obviously the address. I had thought about using dlopen to load the binary but obviously I don't have a symbol to load as the binary has been stripped. Could I somehow call the function without a symbol table? Or do I have to rebuild the symbol table of the binary to then use dlsym to locate and load the symbol?

4

You can call a function at any address. So, load the dynamic library into your process address space, figure out the base of the newly loaded library and take the offset from the base of the library of the function you wan't to call and add that together.

So if IDA says the base of the binary is 0x4000 and your function is at address 0x4100, then you have an offset of 0x100. Then if you load your library it winds up getting loaded at address 0x8000, you make a function pointer (with the correct signature of course) pointing at address 0x8000 + 0x100 and call it. Depending on your platform the base you get for your dynamic library from the platform loader may be further offset from the actual base IDA shows.

Another option is of course to add a new export definition for your sub_xxx() function to the dynamic library and having the loader actually handle any relocations. It will be far more reliable, will allow you to name the function something sane so that you can handle future updates to the library where the function address changes simply by re-adding your new export to the new version. Use something like BinDiff to find the new location of the function.

The third popular option is to use something similar to IDAs FLIRT signatures in order to scan the loaded dynamic library for the function directly in memory. It's generally called signature scanning and here's a more thorough explanation of the concept on the Windows platform. Very simplified it's a technique for finding a function based off of pattern extracted from the function prologue.

In your case you control the application from what I can see and want to call into a dynamic library you don't have the source for. In that case I would probably go with the second option or the first one if you know that the library will never change.

| improve this answer | |
  • I like the first option, I am thinking of using dlopen to open the library but then how do I get the address of the loaded library in code? I could look at /proc/maps etc but it would be nice to grab it in code. – allbabel Jun 6 '14 at 6:42
  • @allbabel I haven't done this myself but could you perhaps use library = dlopen("path", RTLD_NOW), then address = dlsym(library, "some_known_exported_function"). Then take the offset of your function from the known exported function and add that to the value returned by dlsym? – Peter Andersson Jun 13 '14 at 20:01
0

I do not know your exact case. But if the binary is just stripped (or sstrip is used) and your function is just a call to an external symbol of a dynamic library, you might want to take a look at this little IDA python script of mine: http://h4des.org/blog/index.php?/archives/343-Restoring-external-symbol-calls-in-IDA-when-ELF-sections-are-deleted.html

This script uses an ELF parser library I wrote (called ZwoELF) that tries to only use information that the ELF loader is using to circumvent problems that almost all analysis tools/frameworks I tested have because they rely on optional data like ELF sections.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.