Questions tagged [libraries]

Libraries are special computer programs made as a collection of functions which are meant to be called as external resources by multiple programs.

Filter by
Sorted by
Tagged with
11
votes
1answer
5k views

How are stripped shared libraries linked against?

Lately I've been reversing the Android framework for the Nexus S mobile phone. 99% of the source code is of course open, but there are few propriety shared libraries which needs to be downloaded in ...
8
votes
2answers
14k views

Why does `ldd` and `(gdb) info sharedlibrary` show a different library base address?

I see three different outputs for where libc should be loaded. ldd shows the loading address of libc at 0xf7e9e000 $ ldd ~/my_tool linux-gate.so.1 => (0xf7ffe000) libc.so.6 => /lib/...
7
votes
2answers
5k views

Base address of shared objects from ldd output

I'm on a Linux machine with ASLR disabled. Running ldd on a binary gives me the following result : linux-gate.so.1 => (0xb7fe1000) libc.so.6 => /lib/i386-linux-gnu/libc.so.6 (0xb7e5c000) /lib/...
7
votes
1answer
267 views

How to detect internal and shared libraries used in an executable file?

Problem: We want to be able to tell with some certainty that specific versions of internal libraries are being used by a program. For example, if a software uses old, deprecated libraries internally. ...
5
votes
2answers
7k views

OTOOL alternative for linux

I have a reverse engineering set up on a Mac machine. This set up does some reverse engineering on iOS applications(.ipa files). I'm migrating the setup from Mac to a linux machine. Currently on Mac, ...
3
votes
3answers
490 views

Need to extend the list of libraries that a shared (.so) library uses

I have a number of shared libraries calling each other (.so, ARM, Android), binary-only. I want to add logging to some functions, funcA(), ..., funcZ() defined in libsomething.so. The functions are ...
3
votes
1answer
5k views

Decompiling 64bit ARMv8 Android .so library

I know IDA Pro can disassemble them to assembly code, but are there tools to decompile 64bit ARMv8 Android .so shared libraries to C?
3
votes
1answer
909 views

How to determine which thread implementation binary compiled with

Is it possible to determine if a binary (static or shared and not stripped) is compiled with Linuxthreads or NPTL implementation ?
2
votes
2answers
362 views

Is there a good place to search information about known DLLs?

I'm just starting in learning some Reverse Engineering and there are a lot of DLLs being imported or called at runtime and I'd like to know what they do. I would have expected that there would be ...
2
votes
2answers
422 views

How to interpret entries from Exports tab in ProcessHacker

I use ProcessHacker version 2.33 to inspect the functions which are exported by DLLs in running processes. In the screen-shot below you can see a few exported functions from a C++ application, along ...
2
votes
1answer
143 views

Determining an application's library call behaviour

I have a closed source Linux library libfoo that makes calls into another closed source library libbar for additional (mostly unneeded) features. However, I can't use libbar for ethical reasons, so I ...
2
votes
1answer
351 views

How to detect only external-module calls?

I'm debugging one module which draws some letters using either GDI or most possibly Direct Draw. I want to trace where this happens so for the reason I need to trace only instances of code, which ...
2
votes
1answer
335 views

Ghidra : iOS Application : Mach-O binary -> Symbol files of dylib or framework are not generated

I'm performing my first reverse on a Mach-O file binary through Ghidra. My problem is that Ghidra doesn't create symbol files of the dylib/frameworks that are loaded in the project. It is really ...
1
vote
2answers
2k views

How to figure out which library a native JNI function is calling?

I'm trying to perform static analysis on Android framework code, and I'm coming across some Java methods that are calling JNI functions. How do I figure out which native libraries these functions ...
1
vote
1answer
47 views

How to call a func in an executable binary?

I have a binary with a func that I can disassemble. What are simple ways for me to call it with arbitrary args and observe its return val and behavior? Ideally, I'd like to do this: Within gdb (or ...
1
vote
1answer
162 views

How can I see when a library is being called in Android?

Apologies for a beginner-esque question, but I am reverse engineering an Android application, that is most probably using the libusbhost.so library to interface with USB devices via Java Native ...
1
vote
1answer
645 views

How to find the executable code of the native method in the library * .so? (Android)

I'm doing reverse engineering of a mobile application for android and I had a question how to find the executable code of the native method in the library * .so. From the code of the code, the native ...
1
vote
1answer
932 views

Function dependencies in static libraries

I read in another SO thread: With static libraries, the unit of copying is the object file in the library. In other words, if two programs call a function from a certain object file, both ...
1
vote
2answers
176 views

How to find the version number of Android Ad libraries from reverse engineered apps?

I am analysing Android ad libraries. I have downloaded apps from Google play and used dex2jar and JDGUI to recover the Java code of the app. As expected a lot of apps use ad libraries (such ad Google ...
1
vote
1answer
82 views

Ida Pro doesn't recognize known function

I open statically Arm binary with Ida Pro. While I reversing I find out some function like strstr and memcpy and etc. That Ida doesn't understand that those function are strstr and memcpy(for example) ...
1
vote
1answer
90 views

Reversing a .LIB file

So I found an mp3 player the other day and I thought it'd be fun to try and reverse engineer the files I found on it (and maybe even try to modify it). When I plugged it in to my pc I was surprised to ...
1
vote
1answer
77 views

macOS under M1, cannot find library

I'm looking for the following dylib file which is included from process loginwindow. If I run vmmap to inspect loginwindow while it's up and running I get : user@mycomp / % sudo vmmap -I ``pgrep ...
1
vote
2answers
79 views

Cannot disassemble exported functions

I want to disassemble a function from Kernel32.dll to see what it does, but every single function I try looks like this in the decompiler: Function: jmp ds:Function_0 Where is the function? ...
1
vote
1answer
948 views

ldd doesn't show dynamic libraries

I'm trying understand how some parts of a closed source program distributed as a stripped binary implemented. When I run ldd on the program, it prints only 4-5 most basic C libraries as dynamic ...
1
vote
2answers
3k views

How to verify that an Android Application & Library is correctly obfuscated

I have developed an Android Application with some data crunching inside a C library (NDK). In order to protect the library code: I have obfuscated the code with ProGuard and exported it in ...
1
vote
1answer
62 views

How to insert arm instructions into a function in a native library?

I am new and am still learning assembly languuage. In a native android app library that has been disassembled i found this function which had 1 instruction. addres hex arm instruction ...
1
vote
0answers
40 views

Instruction-level hooking library for win32?

I am looking for instruction-level hooking library for win32 x86/x64. I want to write hook insertion and hook implementation code in C/C++ (compiled into dll). (Therefore instrumentation tools are ...
1
vote
0answers
181 views

IDA shows MEMORY or unknown references on C std library calls (memset, memcpy, etc.)

I'm currently reversing a Linux 32-bit executable (with a statically linked library included in it) but I'm having a little problem I can't find a solution for. Basically whenever I stumble across a ...
1
vote
0answers
105 views

How to find implementation of native method in the library .so (Android)

I need to make reverse engineering of one android app. In this app I found class with name Im2MessageNative, this class contains a lot of native methods. For example: static native long ...
1
vote
0answers
252 views

Calling functions of a shared object (.so) extracted from an APK

Decompiling a regular Android application I noticed that its code uses some native functions. So, unpacking the (.apk) file I found the usual "lib" folder and under that a series of folders for ...
1
vote
0answers
142 views

IDA Pro how debug constant function returning different results?

The code below is executed with the parameters (0, 4, 0) , the first 0 being an int pointer casted to an int, and these are the same every time. After execution, a 3 digit number string is returned/...
1
vote
0answers
536 views

Android shared Library (.so)

I quite quite new to reverse engineering in General and there are a couple of things I'm unsure of. The app I am reverse engineering uses a couple of android libs in order to sign requests. So far I'...
0
votes
1answer
176 views

ida identifies library function as regular function

I'm trying to find libc symbols in some Windows 32-bit application. For some reason, Ida autoanalysis didn't recognized code that comes from libc as "library function", but as a "regular function". ...
0
votes
2answers
160 views

Antidebug/reverse engineering targeted for libraries [closed]

So I'm reading about antidebug and anti-reverse engineering techniques, but these cover, in all the docs I've seen, just executables. Are there any resources that target specifically shared and ...
0
votes
1answer
248 views

How to view the functions of a loaded library in x64dbg

I am working on a packed file with UPX. In one of the lines it calls to the value of the address 0xF5222C which is: 0x778057c0. The debugger auto-completes it to kernel32.LoadLibraryA. Where can I ...
0
votes
0answers
78 views

Why rundll32.exe could be loading a DLL multiple times?

Since I started reverse engineering I've found multiple DLLs that when being debugged(IDA + WindDBG) would be unloaded and reloaded continuously without any evident reason. Most of the time I use ...
-1
votes
1answer
192 views

Fixing Indirect Jump as Call?

I have been using Ghidra to decompile a library. When I analyzed the decompiled version of a function, it resulted in this following output. { /* WARNING: Treating indirect jump ...