Questions tagged [libraries]
Libraries are special computer programs made as a collection of functions which are meant to be called as external resources by multiple programs.
45
questions
0
votes
0
answers
20
views
Automatically rename known functions from libraries in IDA
I have a binary file written in c and c++ which uses some libraries. The C/C++ source code of these libraries is publicly accessible online (github). Is there a way in IDA to somehow import this ...
1
vote
0
answers
40
views
Reverse engineer obfuscated Android SDK files (DJI Mobile SDK)
For a hobby project, I would like to be able to control the DJI Mini 3 drone with my PC. Ideally, I would love if I were able to just use the DJI Tello, but it does not have a long enough battery ...
1
vote
2
answers
66
views
How to find what are all the third party apps used in an android app manually by decompiling an apk
How to find all the Third Party Libraries (TPLs) used in an android app after de-compiling apk using jadx? I have looked at this answer but this is too vague.
I can use tools such as Libradar etc. but ...
- 13
0
votes
0
answers
64
views
Improving the output of pseudocode C++ code from IDA Pro
I have some specific questions and some general ones about reverse-engineering a dynamic shared library via IDA Pro 8.3:
If I know the compiler used and compiler flags used (via readelf --debug-dump),...
- 143
1
vote
0
answers
61
views
What factors affect the base address of a shared object?
I'm looking at a CVE for an old thrift shop router that amounts to a stack based buffer overflow with no NULL characters allowed. I can control the instruction pointer register as well as a few less ...
- 105
4
votes
0
answers
457
views
Ghidra not loading classes and types of external library
I'm analyzing a mac OS framework, and while redefining types in the decompilation view,
I wish to define one of the types as a type defined as NSData class which is defined inside CoureFoundation ...
- 185
5
votes
1
answer
182
views
Check if libc.so use tcache
I have ARM libc.so (GLIBC), How can I check if that libc.so used tcache, and what is the value of arena_max?
Can I check that information offline?
- 281
5
votes
1
answer
167
views
Zlib structure inside a GCC static library
I'm trying to analyze a GCC static library which is a part of a commercial software.
First, I used IDA Pro to analyze entire Lib file, but it could find only object files and was unable to disassemble ...
- 151
3
votes
1
answer
2k
views
How to call a func in an executable binary?
I have a binary with a func that I can disassemble. What are simple ways for me to call it with arbitrary args and observe its return val and behavior?
Ideally, I'd like to do this:
Within gdb (or ...
- 267
1
vote
1
answer
125
views
How to insert arm instructions into a function in a native library?
I am new and am still learning assembly languuage. In a native android app library that has been disassembled i found this function which had 1 instruction.
addres hex arm instruction ...
- 164
2
votes
1
answer
494
views
Ida Pro doesn't recognize known function
I open statically Arm binary with Ida Pro.
While I reversing I find out some function like strstr and memcpy and etc. That Ida doesn't understand that those function are strstr and memcpy(for example)
...
1
vote
2
answers
885
views
Reversing a .LIB file
So I found an mp3 player the other day and I thought it'd be fun to try and reverse engineer the files I found on it (and maybe even try to modify it). When I plugged it in to my pc I was surprised to ...
- 11
1
vote
0
answers
255
views
Why rundll32.exe could be loading a DLL multiple times?
Since I started reverse engineering I've found multiple DLLs that when being debugged(IDA + WindDBG) would be unloaded and reloaded continuously without any evident reason.
Most of the time I use ...
- 11
1
vote
1
answer
258
views
macOS under M1, cannot find library
I'm looking for the following dylib file which is included from process loginwindow.
If I run vmmap to inspect loginwindow while it's up and running I get :
user@mycomp / % sudo vmmap -I ``pgrep ...
- 293
-1
votes
1
answer
1k
views
Fixing Indirect Jump as Call?
I have been using Ghidra to decompile a library. When I analyzed the decompiled version of a function, it resulted in this following output.
{
/* WARNING: Treating indirect jump ...
2
votes
1
answer
2k
views
Ghidra : iOS Application : Mach-O binary -> Symbol files of dylib or framework are not generated
I'm performing my first reverse on a Mach-O file binary through Ghidra. My problem is that Ghidra doesn't create symbol files of the dylib/frameworks that are loaded in the project. It is really ...
- 21
1
vote
2
answers
327
views
Cannot disassemble exported functions
I want to disassemble a function from Kernel32.dll to see what it does, but every single function I try looks like this in the decompiler:
Function:
jmp ds:Function_0
Where is the function? ...
- 111
1
vote
1
answer
1k
views
How can I see when a library is being called in Android?
Apologies for a beginner-esque question, but I am reverse engineering an Android application, that is most probably using the libusbhost.so library to interface with USB devices via Java Native ...
- 143
1
vote
0
answers
109
views
Instruction-level hooking library for win32?
I am looking for instruction-level hooking library for win32 x86/x64.
I want to write hook insertion and hook implementation code in C/C++ (compiled into dll).
(Therefore instrumentation tools are ...
- 111
0
votes
1
answer
2k
views
How to view the functions of a loaded library in x64dbg
I am working on a packed file with UPX.
In one of the lines it calls to the value of the address 0xF5222C which is: 0x778057c0.
The debugger auto-completes it to kernel32.LoadLibraryA.
Where can I ...
- 583
0
votes
1
answer
825
views
ida identifies library function as regular function
I'm trying to find libc symbols in some Windows 32-bit application. For some reason, Ida autoanalysis didn't recognized code that comes from libc as "library function", but as a "regular function". ...
- 103
1
vote
0
answers
314
views
IDA shows MEMORY or unknown references on C std library calls (memset, memcpy, etc.)
I'm currently reversing a Linux 32-bit executable (with a statically linked library included in it) but I'm having a little problem I can't find a solution for.
Basically whenever I stumble across a ...
1
vote
0
answers
198
views
How to find implementation of native method in the library .so (Android)
I need to make reverse engineering of one android app.
In this app I found class with name Im2MessageNative, this class contains a lot of native methods.
For example:
static native long ...
1
vote
0
answers
579
views
Calling functions of a shared object (.so) extracted from an APK
Decompiling a regular Android application I noticed that its code uses some native functions. So, unpacking the (.apk) file I found the usual "lib" folder and under that a series of folders for ...
- 11
1
vote
0
answers
184
views
IDA Pro how debug constant function returning different results?
The code below is executed with the parameters (0, 4, 0) , the first 0 being an int pointer casted to an int, and these are the same every time. After execution, a 3 digit number string is returned/...
- 121
9
votes
2
answers
15k
views
OTOOL alternative for linux
I have a reverse engineering set up on a Mac machine. This set up does some reverse engineering on iOS applications(.ipa files). I'm migrating the setup from Mac to a linux machine.
Currently on Mac, ...
- 243
2
votes
2
answers
539
views
Is there a good place to search information about known DLLs?
I'm just starting in learning some Reverse Engineering and there are a lot of DLLs being imported or called at runtime and I'd like to know what they do. I would have expected that there would be ...
- 380
1
vote
1
answer
799
views
How to find the executable code of the native method in the library * .so? (Android)
I'm doing reverse engineering of a mobile application for android and I had a question how to find the executable code of the native method in the library * .so. From the code of the code, the native ...
- 11
8
votes
1
answer
397
views
How to detect internal and shared libraries used in an executable file?
Problem: We want to be able to tell with some certainty that specific versions of internal libraries are being used by a program. For example, if a software uses old, deprecated libraries internally. ...
- 233
2
votes
1
answer
204
views
Determining an application's library call behaviour
I have a closed source Linux library libfoo that makes calls into another closed source library libbar for additional (mostly unneeded) features. However, I can't use libbar for ethical reasons, so I ...
- 123
3
votes
1
answer
8k
views
Decompiling 64bit ARMv8 Android .so library
I know IDA Pro can disassemble them to assembly code, but are there tools to decompile 64bit ARMv8 Android .so shared libraries to C?
- 359
1
vote
2
answers
2k
views
How to figure out which library a native JNI function is calling?
I'm trying to perform static analysis on Android framework code, and I'm coming across some Java methods that are calling JNI functions. How do I figure out which native libraries these functions ...
- 359
0
votes
2
answers
185
views
Antidebug/reverse engineering targeted for libraries [closed]
So I'm reading about antidebug and anti-reverse engineering techniques, but these cover, in all the docs I've seen, just executables.
Are there any resources that target specifically shared and ...
- 103
1
vote
1
answer
1k
views
Function dependencies in static libraries
I read in another SO thread:
With static libraries, the unit of copying is the object file in the
library.
In other words, if two programs call a function from a certain object file, both ...
- 1,560
1
vote
0
answers
623
views
Android shared Library (.so)
I quite quite new to reverse engineering in General and there are a couple of things I'm unsure of. The app I am reverse engineering uses a couple of android libs in order to sign requests. So far I'...
- 31
1
vote
1
answer
1k
views
ldd doesn't show dynamic libraries
I'm trying understand how some parts of a closed source program distributed as a stripped binary implemented. When I run ldd on the program, it prints only 4-5 most basic C libraries as dynamic ...
- 233
2
votes
1
answer
455
views
How to detect only external-module calls?
I'm debugging one module which draws some letters using either GDI or most possibly Direct Draw. I want to trace where this happens so for the reason I need to trace only instances of code, which ...
- 421
9
votes
2
answers
16k
views
Why does `ldd` and `(gdb) info sharedlibrary` show a different library base address?
I see three different outputs for where libc should be loaded.
ldd shows the loading address of libc at 0xf7e9e000
$ ldd ~/my_tool
linux-gate.so.1 => (0xf7ffe000)
libc.so.6 => /lib/...
- 3,079
3
votes
1
answer
1k
views
How to determine which thread implementation binary compiled with
Is it possible to determine if a binary (static or shared and not stripped) is compiled with Linuxthreads or NPTL implementation ?
- 145
1
vote
2
answers
193
views
How to find the version number of Android Ad libraries from reverse engineered apps?
I am analysing Android ad libraries. I have downloaded apps from Google play and used dex2jar and JDGUI to recover the Java code of the app. As expected a lot of apps use ad libraries (such ad Google ...
- 201
3
votes
3
answers
609
views
Need to extend the list of libraries that a shared (.so) library uses
I have a number of shared libraries calling each other (.so, ARM, Android), binary-only.
I want to add logging to some functions, funcA(), ..., funcZ() defined in libsomething.so.
The functions are ...
2
votes
2
answers
564
views
How to interpret entries from Exports tab in ProcessHacker
I use ProcessHacker version 2.33 to inspect the functions which are exported by DLLs in running processes. In the screen-shot below you can see a few exported functions from a C++ application, along ...
- 828
1
vote
2
answers
3k
views
How to verify that an Android Application & Library is correctly obfuscated
I have developed an Android Application with some data crunching inside a C library (NDK).
In order to protect the library code:
I have obfuscated the code with ProGuard and exported it in ...
- 11
12
votes
1
answer
5k
views
How are stripped shared libraries linked against?
Lately I've been reversing the Android framework for the Nexus S mobile phone.
99% of the source code is of course open, but there are few propriety shared libraries which needs to be downloaded in ...
- 4,845
8
votes
2
answers
6k
views
Base address of shared objects from ldd output
I'm on a Linux machine with ASLR disabled. Running ldd on a binary gives me the following result :
linux-gate.so.1 => (0xb7fe1000)
libc.so.6 => /lib/i386-linux-gnu/libc.so.6 (0xb7e5c000)
/lib/...
user1743