Questions tagged [libraries]

Libraries are special computer programs made as a collection of functions which are meant to be called as external resources by multiple programs.

Filter by
Sorted by
Tagged with
12 votes
1 answer
5k views

How are stripped shared libraries linked against?

Lately I've been reversing the Android framework for the Nexus S mobile phone. 99% of the source code is of course open, but there are few propriety shared libraries which needs to be downloaded in ...
Mellowcandle's user avatar
  • 4,795
9 votes
2 answers
15k views

Why does `ldd` and `(gdb) info sharedlibrary` show a different library base address?

I see three different outputs for where libc should be loaded. ldd shows the loading address of libc at 0xf7e9e000 $ ldd ~/my_tool linux-gate.so.1 => (0xf7ffe000) libc.so.6 => /lib/...
samuirai's user avatar
  • 3,079
8 votes
2 answers
5k views

Base address of shared objects from ldd output

I'm on a Linux machine with ASLR disabled. Running ldd on a binary gives me the following result : linux-gate.so.1 => (0xb7fe1000) libc.so.6 => /lib/i386-linux-gnu/libc.so.6 (0xb7e5c000) /lib/...
user avatar
8 votes
2 answers
14k views

OTOOL alternative for linux

I have a reverse engineering set up on a Mac machine. This set up does some reverse engineering on iOS applications(.ipa files). I'm migrating the setup from Mac to a linux machine. Currently on Mac, ...
Rohit saraf's user avatar
8 votes
1 answer
387 views

How to detect internal and shared libraries used in an executable file?

Problem: We want to be able to tell with some certainty that specific versions of internal libraries are being used by a program. For example, if a software uses old, deprecated libraries internally. ...
learnerX's user avatar
  • 233
5 votes
1 answer
175 views

Check if libc.so use tcache

I have ARM libc.so (GLIBC), How can I check if that libc.so used tcache, and what is the value of arena_max? Can I check that information offline?
Kokomelom's user avatar
  • 281
5 votes
1 answer
158 views

Zlib structure inside a GCC static library

I'm trying to analyze a GCC static library which is a part of a commercial software. First, I used IDA Pro to analyze entire Lib file, but it could find only object files and was unable to disassemble ...
HamidReza's user avatar
  • 151
4 votes
0 answers
425 views

Ghidra not loading classes and types of external library

I'm analyzing a mac OS framework, and while redefining types in the decompilation view, I wish to define one of the types as a type defined as NSData class which is defined inside CoureFoundation ...
Jorayen's user avatar
  • 185
3 votes
3 answers
600 views

Need to extend the list of libraries that a shared (.so) library uses

I have a number of shared libraries calling each other (.so, ARM, Android), binary-only. I want to add logging to some functions, funcA(), ..., funcZ() defined in libsomething.so. The functions are ...
18446744073709551615's user avatar
3 votes
1 answer
2k views

How to call a func in an executable binary?

I have a binary with a func that I can disassemble. What are simple ways for me to call it with arbitrary args and observe its return val and behavior? Ideally, I'd like to do this: Within gdb (or ...
SRobertJames's user avatar
3 votes
1 answer
7k views

Decompiling 64bit ARMv8 Android .so library

I know IDA Pro can disassemble them to assembly code, but are there tools to decompile 64bit ARMv8 Android .so shared libraries to C?
user1118764's user avatar
3 votes
1 answer
1k views

How to determine which thread implementation binary compiled with

Is it possible to determine if a binary (static or shared and not stripped) is compiled with Linuxthreads or NPTL implementation ?
user3155036's user avatar
2 votes
2 answers
515 views

Is there a good place to search information about known DLLs?

I'm just starting in learning some Reverse Engineering and there are a lot of DLLs being imported or called at runtime and I'd like to know what they do. I would have expected that there would be ...
theTheodidact's user avatar
2 votes
2 answers
554 views

How to interpret entries from Exports tab in ProcessHacker

I use ProcessHacker version 2.33 to inspect the functions which are exported by DLLs in running processes. In the screen-shot below you can see a few exported functions from a C++ application, along ...
Benny's user avatar
  • 828
2 votes
1 answer
200 views

Determining an application's library call behaviour

I have a closed source Linux library libfoo that makes calls into another closed source library libbar for additional (mostly unneeded) features. However, I can't use libbar for ethical reasons, so I ...
Hiko Haieto's user avatar
2 votes
1 answer
453 views

How to detect only external-module calls?

I'm debugging one module which draws some letters using either GDI or most possibly Direct Draw. I want to trace where this happens so for the reason I need to trace only instances of code, which ...
sasho648's user avatar
  • 421
2 votes
1 answer
452 views

Ida Pro doesn't recognize known function

I open statically Arm binary with Ida Pro. While I reversing I find out some function like strstr and memcpy and etc. That Ida doesn't understand that those function are strstr and memcpy(for example) ...
yfr24493AzzrggAcom's user avatar
2 votes
1 answer
2k views

Ghidra : iOS Application : Mach-O binary -> Symbol files of dylib or framework are not generated

I'm performing my first reverse on a Mach-O file binary through Ghidra. My problem is that Ghidra doesn't create symbol files of the dylib/frameworks that are loaded in the project. It is really ...
Kojud's user avatar
  • 21
1 vote
2 answers
2k views

How to figure out which library a native JNI function is calling?

I'm trying to perform static analysis on Android framework code, and I'm coming across some Java methods that are calling JNI functions. How do I figure out which native libraries these functions ...
user1118764's user avatar
1 vote
2 answers
809 views

Reversing a .LIB file

So I found an mp3 player the other day and I thought it'd be fun to try and reverse engineer the files I found on it (and maybe even try to modify it). When I plugged it in to my pc I was surprised to ...
Matthias's user avatar
1 vote
1 answer
257 views

macOS under M1, cannot find library

I'm looking for the following dylib file which is included from process loginwindow. If I run vmmap to inspect loginwindow while it's up and running I get : user@mycomp / % sudo vmmap -I ``pgrep ...
Zohar81's user avatar
  • 293
1 vote
1 answer
1k views

How can I see when a library is being called in Android?

Apologies for a beginner-esque question, but I am reverse engineering an Android application, that is most probably using the libusbhost.so library to interface with USB devices via Java Native ...
Timotej Leginus's user avatar
1 vote
1 answer
795 views

How to find the executable code of the native method in the library * .so? (Android)

I'm doing reverse engineering of a mobile application for android and I had a question how to find the executable code of the native method in the library * .so. From the code of the code, the native ...
Sergey Unk's user avatar
1 vote
1 answer
1k views

Function dependencies in static libraries

I read in another SO thread: With static libraries, the unit of copying is the object file in the library. In other words, if two programs call a function from a certain object file, both ...
langlauf.io's user avatar
  • 1,560
1 vote
2 answers
191 views

How to find the version number of Android Ad libraries from reverse engineered apps?

I am analysing Android ad libraries. I have downloaded apps from Google play and used dex2jar and JDGUI to recover the Java code of the app. As expected a lot of apps use ad libraries (such ad Google ...
Annamalai N's user avatar
1 vote
2 answers
302 views

Cannot disassemble exported functions

I want to disassemble a function from Kernel32.dll to see what it does, but every single function I try looks like this in the decompiler: Function: jmp ds:Function_0 Where is the function? ...
Carol Victor's user avatar
1 vote
1 answer
1k views

ldd doesn't show dynamic libraries

I'm trying understand how some parts of a closed source program distributed as a stripped binary implemented. When I run ldd on the program, it prints only 4-5 most basic C libraries as dynamic ...
sinan's user avatar
  • 233
1 vote
2 answers
3k views

How to verify that an Android Application & Library is correctly obfuscated

I have developed an Android Application with some data crunching inside a C library (NDK). In order to protect the library code: I have obfuscated the code with ProGuard and exported it in ...
trizioPucci's user avatar
1 vote
0 answers
53 views

What factors affect the base address of a shared object?

I'm looking at a CVE for an old thrift shop router that amounts to a stack based buffer overflow with no NULL characters allowed. I can control the instruction pointer register as well as a few less ...
Matthew Tingum's user avatar
1 vote
1 answer
125 views

How to insert arm instructions into a function in a native library?

I am new and am still learning assembly languuage. In a native android app library that has been disassembled i found this function which had 1 instruction. addres hex arm instruction ...
Silent's user avatar
  • 164
1 vote
0 answers
244 views

Why rundll32.exe could be loading a DLL multiple times?

Since I started reverse engineering I've found multiple DLLs that when being debugged(IDA + WindDBG) would be unloaded and reloaded continuously without any evident reason. Most of the time I use ...
hariseldon's user avatar
1 vote
0 answers
108 views

Instruction-level hooking library for win32?

I am looking for instruction-level hooking library for win32 x86/x64. I want to write hook insertion and hook implementation code in C/C++ (compiled into dll). (Therefore instrumentation tools are ...
user2771324's user avatar
1 vote
0 answers
305 views

IDA shows MEMORY or unknown references on C std library calls (memset, memcpy, etc.)

I'm currently reversing a Linux 32-bit executable (with a statically linked library included in it) but I'm having a little problem I can't find a solution for. Basically whenever I stumble across a ...
Davide Maggioni's user avatar
1 vote
0 answers
195 views

How to find implementation of native method in the library .so (Android)

I need to make reverse engineering of one android app. In this app I found class with name Im2MessageNative, this class contains a lot of native methods. For example: static native long ...
Данил Вагапов's user avatar
1 vote
0 answers
569 views

Calling functions of a shared object (.so) extracted from an APK

Decompiling a regular Android application I noticed that its code uses some native functions. So, unpacking the (.apk) file I found the usual "lib" folder and under that a series of folders for ...
Dadex's user avatar
  • 11
1 vote
0 answers
182 views

IDA Pro how debug constant function returning different results?

The code below is executed with the parameters (0, 4, 0) , the first 0 being an int pointer casted to an int, and these are the same every time. After execution, a 3 digit number string is returned/...
Charlie Niekirk's user avatar
1 vote
0 answers
622 views

Android shared Library (.so)

I quite quite new to reverse engineering in General and there are a couple of things I'm unsure of. The app I am reverse engineering uses a couple of android libs in order to sign requests. So far I'...
Xylynx's user avatar
  • 31
0 votes
1 answer
774 views

ida identifies library function as regular function

I'm trying to find libc symbols in some Windows 32-bit application. For some reason, Ida autoanalysis didn't recognized code that comes from libc as "library function", but as a "regular function". ...
Z E Nir's user avatar
  • 103
0 votes
2 answers
184 views

Antidebug/reverse engineering targeted for libraries [closed]

So I'm reading about antidebug and anti-reverse engineering techniques, but these cover, in all the docs I've seen, just executables. Are there any resources that target specifically shared and ...
senseiwa's user avatar
  • 103
0 votes
1 answer
2k views

How to view the functions of a loaded library in x64dbg

I am working on a packed file with UPX. In one of the lines it calls to the value of the address 0xF5222C which is: 0x778057c0. The debugger auto-completes it to kernel32.LoadLibraryA. Where can I ...
E235's user avatar
  • 583
0 votes
0 answers
45 views

Improving the output of pseudocode C++ code from IDA Pro

I have some specific questions and some general ones about reverse-engineering a dynamic shared library via IDA Pro 8.3: If I know the compiler used and compiler flags used (via readelf --debug-dump),...
HCSF's user avatar
  • 143
0 votes
0 answers
112 views

Ghidra - Mach-O failed to load external libraries

I'm trying to follow the steps in the book "The Art of Mac Malware" and disassemble the malicious part (the patch binary) of the EvilQuest malware with Ghidra instead of Hopper or IDA. (...
pudi's user avatar
  • 180
-1 votes
1 answer
954 views

Fixing Indirect Jump as Call?

I have been using Ghidra to decompile a library. When I analyzed the decompiled version of a function, it resulted in this following output. { /* WARNING: Treating indirect jump ...
waslemon12's user avatar