Questions tagged [libraries]

Libraries are special computer programs made as a collection of functions which are meant to be called as external resources by multiple programs.

Filter by
Sorted by
Tagged with
4
votes
1answer
5k views

OTOOL alternative for linux

I have a reverse engineering set up on a Mac machine. This set up does some reverse engineering on iOS applications(.ipa files). I'm migrating the setup from Mac to a linux machine. Currently on Mac, ...
-1
votes
1answer
50 views

Fixing Indirect Jump as Call?

I have been using Ghidra to decompile a library. When I analyzed the decompiled version of a function, it resulted in this following output. { /* WARNING: Treating indirect jump ...
1
vote
1answer
31 views

macOS under M1, cannot find library

I'm looking for the following dylib file which is included from process loginwindow. If I run vmmap to inspect loginwindow while it's up and running I get : user@mycomp / % sudo vmmap -I ``pgrep ...
1
vote
0answers
52 views

Ghidra : iOS Application : Mach-O binary -> Symbol files of dylib or framework are not generated

I'm performing my first reverse on a Mach-O file binary through Ghidra. My problem is that Ghidra doesn't create symbol files of the dylib/frameworks that are loaded in the project. It is really ...
1
vote
2answers
51 views

Cannot disassemble exported functions

I want to disassemble a function from Kernel32.dll to see what it does, but every single function I try looks like this in the decompiler: Function: jmp ds:Function_0 Where is the function? ...
1
vote
1answer
72 views

How can I see when a library is being called in Android?

Apologies for a beginner-esque question, but I am reverse engineering an Android application, that is most probably using the libusbhost.so library to interface with USB devices via Java Native ...
1
vote
0answers
29 views

Instruction-level hooking library for win32?

I am looking for instruction-level hooking library for win32 x86/x64. I want to write hook insertion and hook implementation code in C/C++ (compiled into dll). (Therefore instrumentation tools are ...
0
votes
1answer
63 views

How to view the functions of a loaded library in x64dbg

I am working on a packed file with UPX. In one of the lines it calls to the value of the address 0xF5222C which is: 0x778057c0. The debugger auto-completes it to kernel32.LoadLibraryA. Where can I ...
2
votes
1answer
4k views

Decompiling 64bit ARMv8 Android .so library

I know IDA Pro can disassemble them to assembly code, but are there tools to decompile 64bit ARMv8 Android .so shared libraries to C?
0
votes
1answer
83 views

ida identifies library function as regular function

I'm trying to find libc symbols in some Windows 32-bit application. For some reason, Ida autoanalysis didn't recognized code that comes from libc as "library function", but as a "regular function". ...
1
vote
0answers
125 views

IDA shows MEMORY or unknown references on C std library calls (memset, memcpy, etc.)

I'm currently reversing a Linux 32-bit executable (with a statically linked library included in it) but I'm having a little problem I can't find a solution for. Basically whenever I stumble across a ...
1
vote
0answers
85 views

How to find implementation of native method in the library .so (Android)

I need to make reverse engineering of one android app. In this app I found class with name Im2MessageNative, this class contains a lot of native methods. For example: static native long ...
1
vote
0answers
160 views

Calling functions of a shared object (.so) extracted from an APK

Decompiling a regular Android application I noticed that its code uses some native functions. So, unpacking the (.apk) file I found the usual "lib" folder and under that a series of folders for ...
1
vote
0answers
127 views

IDA Pro how debug constant function returning different results?

The code below is executed with the parameters (0, 4, 0) , the first 0 being an int pointer casted to an int, and these are the same every time. After execution, a 3 digit number string is returned/...
1
vote
2answers
174 views

How to find the version number of Android Ad libraries from reverse engineered apps?

I am analysing Android ad libraries. I have downloaded apps from Google play and used dex2jar and JDGUI to recover the Java code of the app. As expected a lot of apps use ad libraries (such ad Google ...
7
votes
1answer
232 views

How to detect internal and shared libraries used in an executable file?

Problem: We want to be able to tell with some certainty that specific versions of internal libraries are being used by a program. For example, if a software uses old, deprecated libraries internally. ...
1
vote
1answer
585 views

How to find the executable code of the native method in the library * .so? (Android)

I'm doing reverse engineering of a mobile application for android and I had a question how to find the executable code of the native method in the library * .so. From the code of the code, the native ...
2
votes
2answers
292 views

Is there a good place to search information about known DLLs?

I'm just starting in learning some Reverse Engineering and there are a lot of DLLs being imported or called at runtime and I'd like to know what they do. I would have expected that there would be ...
2
votes
1answer
139 views

Determining an application's library call behaviour

I have a closed source Linux library libfoo that makes calls into another closed source library libbar for additional (mostly unneeded) features. However, I can't use libbar for ethical reasons, so I ...
1
vote
2answers
2k views

How to figure out which library a native JNI function is calling?

I'm trying to perform static analysis on Android framework code, and I'm coming across some Java methods that are calling JNI functions. How do I figure out which native libraries these functions ...
1
vote
1answer
896 views

Function dependencies in static libraries

I read in another SO thread: With static libraries, the unit of copying is the object file in the library. In other words, if two programs call a function from a certain object file, both ...
0
votes
2answers
157 views

Antidebug/reverse engineering targeted for libraries [closed]

So I'm reading about antidebug and anti-reverse engineering techniques, but these cover, in all the docs I've seen, just executables. Are there any resources that target specifically shared and ...
3
votes
1answer
879 views

How to determine which thread implementation binary compiled with

Is it possible to determine if a binary (static or shared and not stripped) is compiled with Linuxthreads or NPTL implementation ?
1
vote
0answers
529 views

Android shared Library (.so)

I quite quite new to reverse engineering in General and there are a couple of things I'm unsure of. The app I am reverse engineering uses a couple of android libs in order to sign requests. So far I'...
0
votes
1answer
923 views

ldd doesn't show dynamic libraries

I'm trying understand how some parts of a closed source program distributed as a stripped binary implemented. When I run ldd on the program, it prints only 4-5 most basic C libraries as dynamic ...
2
votes
1answer
336 views

How to detect only external-module calls?

I'm debugging one module which draws some letters using either GDI or most possibly Direct Draw. I want to trace where this happens so for the reason I need to trace only instances of code, which ...
8
votes
2answers
13k views

Why does `ldd` and `(gdb) info sharedlibrary` show a different library base address?

I see three different outputs for where libc should be loaded. ldd shows the loading address of libc at 0xf7e9e000 $ ldd ~/my_tool linux-gate.so.1 => (0xf7ffe000) libc.so.6 => /lib/...
3
votes
3answers
476 views

Need to extend the list of libraries that a shared (.so) library uses

I have a number of shared libraries calling each other (.so, ARM, Android), binary-only. I want to add logging to some functions, funcA(), ..., funcZ() defined in libsomething.so. The functions are ...
1
vote
2answers
3k views

How to verify that an Android Application & Library is correctly obfuscated

I have developed an Android Application with some data crunching inside a C library (NDK). In order to protect the library code: I have obfuscated the code with ProGuard and exported it in ...
2
votes
2answers
377 views

How to interpret entries from Exports tab in ProcessHacker

I use ProcessHacker version 2.33 to inspect the functions which are exported by DLLs in running processes. In the screen-shot below you can see a few exported functions from a C++ application, along ...
11
votes
1answer
4k views

How are stripped shared libraries linked against?

Lately I've been reversing the Android framework for the Nexus S mobile phone. 99% of the source code is of course open, but there are few propriety shared libraries which needs to be downloaded in ...
7
votes
2answers
5k views

Base address of shared objects from ldd output

I'm on a Linux machine with ASLR disabled. Running ldd on a binary gives me the following result : linux-gate.so.1 => (0xb7fe1000) libc.so.6 => /lib/i386-linux-gnu/libc.so.6 (0xb7e5c000) /lib/...