Doing some messing around with ELF (of both the x86 and ARM varieties).
Associating symbol names with entries in the
.got section is straightforward. Find the
.got section, find the relocation section
.sh_info contains the index of the
.got, and find the symbol section
.dynsym that contains the symbol names.
Everything lines up nicely between these sections, and I can accurately assign symbol names to entries in the
However, I also want names for the stubs in the
.plt section. A rough percentage of the time, symbols for the
.plt can be inferred based on the ordering of
.got symbols, and an offset from the base of the
.plt section. For whatever reason, occasionally this is not the case.
objdump can accurately generate them for x86, and IDA can accurately generate them for x86 and ARM (both without
-g debugging symbols). How are these generated?
In the case of IDA, I could reasonably assume there's some advanced logic going on based on interpretation of the instructions in the
.plt, but I know that must not be the case for