4

I would like to make IDA disassemble the .plt section of ELF files correctly, e.g. as objdump does: 

objdump -D -M intel asdf | grep "Disassembly of section .plt" -A80

objdump disassembly

I don't know why but IDA gives me this (Note the dw ? and dq ?): IDA disassembly

Even the IDA hexeditor does not show me the correct values at the corresponding addresses, but gives me ??s.

I tried selecting and deselecting the settings described in the IDA Online help (search for "PLT") but this didn't help...

0: Replace PIC form of 'Procedure Linkage Table' to non PIC form

1: Direct jumping from PLT (without GOT) regardless of its form

2: Convert PIC form of loading _GLOBAL_OFFSET_TABLE_[] of address

3: Obliterate auxiliary bytes in PLT & GOT for 'final autoanalysis'

4: Natural form of PIC GOT address loading in relocatable file

5: Unpatched form of PIC GOT references in relocatable file

How can I configure IDA so that I can access the instructions in the .plt section of an ELF file with IDAPython?

Improve this question

1 Answer 1

Reset to default
2

For a 32bit (but not 64bit) x86 ELF binary, selecting the following options works:

enter image description here enter image description here enter image description here

UPDATE:

There is a bug in IDA 6.8 (and probably earlier versions): For 64bit x86 ELF binaries, I get the desired disassembly result only when additionally deselecting "Replace PIC form of ...".

This was the reason for my confusion and made me post my question.

Hex-rays sent me a patch which fixed it (and which will probably be part of future versions... )

Improve this answer
3
  • hello, how do you reach the settings "ELF patching (for PIC) and viewing mode" ? I can not find it
    – user3097712
    Feb 28, 2016 at 15:14
  • 1
    @user3097712 : In the "Load a new file" window, select "Loading options". See the checkmark in the left-hand screen shot. After that, the window you are asking for should appear automatically after hitting ok in the "Load a new file" window. Please tell me if it works.
    – langlauf.io
    Feb 28, 2016 at 15:18
  • @user3097712 : if this works for you, you can of course upvote my answer :- )
    – langlauf.io
    Feb 28, 2016 at 18:15

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.