We all know that in typical programs, there exist some references.
When compiling, linker will translate all the memory references into concrete memory addresses during the symbol relocation step. And by doing some quick experiments (IDA-Pro 6.4), I notice that IDA-Pro can help to lift these memory addresses back into symbols.
However, I found that the symbolization functionality of IDA-Pro can be mislead by some cases. So what I am interested is to calculate how many references have been recovered by IDA-Pro. I am asking that is there anyway to obtain the information of "how many memory references are recovered by IDA-Pro?"
Thanks @Jason a lot for his answer, but what I am trying to do is not collect all the labels. Here is an example:
Please pay attention to the symbol sub_80484AE
in address 0x804a020
. Note that the 4 byte data 0x08, 0x04, 0x84, 0xae
in porocessed binary are considered as a symbol, as it is equal to the beginning address of function sub_80484AE
. This is true. However, as no instruction refers to the address 0x804A020
, so there is no name
in address 0x804a020
.
What I want to collect is all the symbols with its corresponding address, for example, in the above case, I need to collect this
0x804a018 : sub_804847b
0x804a01dc : _strchr
0x804a020 : sub_80484AE
Am I clear enough? I really appreciate if anyone can give me some help! Thank you a lot!!
----------------------------------------------- update ---------------------------------------
Am I still not clear enough?
Let me put it in this way. Can I obtain all the symbol information which used to be resolved by linker? Say, in the picture I updated, during compiling linker resolved three symbols, at memory address 0x804a018, 0x804a01dc, 0x804a020. IDA-Pro recovers some of these information. So I want to collect all the IDA recovered symbol information (this information could be function name, or it could be an entry of jump table, or it could be a jump destination, as I draw in the picture).
Note that I want to recover the information in a format that each resolved symbol together with the memory address. For example in the picture, it should be:
0x804a018 : sub_804847b
0x804a01dc : _strchr
0x804a020 : sub_80484AE
I am thinking to traverse all the memory address of a binary, and check each the oprend of instruction (or content if it is in the data section), to see whether it is a recovered symbol or not. If so, I will store this symbol together with this instruction (or data)'s memory address.
But basically how to check whether a oprend in a instruction is a symbol?