Questions tagged [libraries]
Libraries are special computer programs made as a collection of functions which are meant to be called as external resources by multiple programs.
40
questions
12
votes
1
answer
5k
views
How are stripped shared libraries linked against?
Lately I've been reversing the Android framework for the Nexus S mobile phone.
99% of the source code is of course open, but there are few propriety shared libraries which needs to be downloaded in ...
- 4,755
9
votes
2
answers
15k
views
Why does `ldd` and `(gdb) info sharedlibrary` show a different library base address?
I see three different outputs for where libc should be loaded.
ldd shows the loading address of libc at 0xf7e9e000
$ ldd ~/my_tool
linux-gate.so.1 => (0xf7ffe000)
libc.so.6 => /lib/...
- 3,039
8
votes
2
answers
5k
views
Base address of shared objects from ldd output
I'm on a Linux machine with ASLR disabled. Running ldd on a binary gives me the following result :
linux-gate.so.1 => (0xb7fe1000)
libc.so.6 => /lib/i386-linux-gnu/libc.so.6 (0xb7e5c000)
/lib/...
user1743
8
votes
2
answers
11k
views
OTOOL alternative for linux
I have a reverse engineering set up on a Mac machine. This set up does some reverse engineering on iOS applications(.ipa files). I'm migrating the setup from Mac to a linux machine.
Currently on Mac, ...
- 233
8
votes
1
answer
346
views
How to detect internal and shared libraries used in an executable file?
Problem: We want to be able to tell with some certainty that specific versions of internal libraries are being used by a program. For example, if a software uses old, deprecated libraries internally. ...
- 233
5
votes
1
answer
99
views
Check if libc.so use tcache
I have ARM libc.so (GLIBC), How can I check if that libc.so used tcache, and what is the value of arena_max?
Can I check that information offline?
- 181
5
votes
1
answer
104
views
Zlib structure inside a GCC static library
I'm trying to analyze a GCC static library which is a part of a commercial software.
First, I used IDA Pro to analyze entire Lib file, but it could find only object files and was unable to disassemble ...
- 151
4
votes
0
answers
110
views
Ghidra not loading classes and types of external library
I'm analyzing a mac OS framework, and while redefining types in the decompilation view,
I wish to define one of the types as a type defined as NSData class which is defined inside CoureFoundation ...
- 153
3
votes
3
answers
522
views
Need to extend the list of libraries that a shared (.so) library uses
I have a number of shared libraries calling each other (.so, ARM, Android), binary-only.
I want to add logging to some functions, funcA(), ..., funcZ() defined in libsomething.so.
The functions are ...
3
votes
1
answer
6k
views
Decompiling 64bit ARMv8 Android .so library
I know IDA Pro can disassemble them to assembly code, but are there tools to decompile 64bit ARMv8 Android .so shared libraries to C?
- 359
3
votes
1
answer
965
views
How to determine which thread implementation binary compiled with
Is it possible to determine if a binary (static or shared and not stripped) is compiled with Linuxthreads or NPTL implementation ?
- 145
2
votes
2
answers
424
views
Is there a good place to search information about known DLLs?
I'm just starting in learning some Reverse Engineering and there are a lot of DLLs being imported or called at runtime and I'd like to know what they do. I would have expected that there would be ...
- 380
2
votes
2
answers
498
views
How to interpret entries from Exports tab in ProcessHacker
I use ProcessHacker version 2.33 to inspect the functions which are exported by DLLs in running processes. In the screen-shot below you can see a few exported functions from a C++ application, along ...
- 828
2
votes
1
answer
842
views
How to call a func in an executable binary?
I have a binary with a func that I can disassemble. What are simple ways for me to call it with arbitrary args and observe its return val and behavior?
Ideally, I'd like to do this:
Within gdb (or ...
- 227
2
votes
1
answer
174
views
Determining an application's library call behaviour
I have a closed source Linux library libfoo that makes calls into another closed source library libbar for additional (mostly unneeded) features. However, I can't use libbar for ethical reasons, so I ...
- 123
2
votes
1
answer
434
views
How to detect only external-module calls?
I'm debugging one module which draws some letters using either GDI or most possibly Direct Draw. I want to trace where this happens so for the reason I need to trace only instances of code, which ...
- 411
2
votes
1
answer
281
views
Ida Pro doesn't recognize known function
I open statically Arm binary with Ida Pro.
While I reversing I find out some function like strstr and memcpy and etc. That Ida doesn't understand that those function are strstr and memcpy(for example)
...
2
votes
1
answer
1k
views
Ghidra : iOS Application : Mach-O binary -> Symbol files of dylib or framework are not generated
I'm performing my first reverse on a Mach-O file binary through Ghidra. My problem is that Ghidra doesn't create symbol files of the dylib/frameworks that are loaded in the project. It is really ...
- 21
1
vote
2
answers
2k
views
How to figure out which library a native JNI function is calling?
I'm trying to perform static analysis on Android framework code, and I'm coming across some Java methods that are calling JNI functions. How do I figure out which native libraries these functions ...
- 359
1
vote
1
answer
438
views
Reversing a .LIB file
So I found an mp3 player the other day and I thought it'd be fun to try and reverse engineer the files I found on it (and maybe even try to modify it). When I plugged it in to my pc I was surprised to ...
- 11
1
vote
1
answer
205
views
macOS under M1, cannot find library
I'm looking for the following dylib file which is included from process loginwindow.
If I run vmmap to inspect loginwindow while it's up and running I get :
user@mycomp / % sudo vmmap -I ``pgrep ...
- 293
1
vote
1
answer
706
views
How can I see when a library is being called in Android?
Apologies for a beginner-esque question, but I am reverse engineering an Android application, that is most probably using the libusbhost.so library to interface with USB devices via Java Native ...
- 143
1
vote
1
answer
711
views
How to find the executable code of the native method in the library * .so? (Android)
I'm doing reverse engineering of a mobile application for android and I had a question how to find the executable code of the native method in the library * .so. From the code of the code, the native ...
- 11
1
vote
1
answer
1k
views
Function dependencies in static libraries
I read in another SO thread:
With static libraries, the unit of copying is the object file in the
library.
In other words, if two programs call a function from a certain object file, both ...
- 1,518
1
vote
2
answers
184
views
How to find the version number of Android Ad libraries from reverse engineered apps?
I am analysing Android ad libraries. I have downloaded apps from Google play and used dex2jar and JDGUI to recover the Java code of the app. As expected a lot of apps use ad libraries (such ad Google ...
- 201
1
vote
2
answers
213
views
Cannot disassemble exported functions
I want to disassemble a function from Kernel32.dll to see what it does, but every single function I try looks like this in the decompiler:
Function:
jmp ds:Function_0
Where is the function? ...
- 111
1
vote
1
answer
1k
views
ldd doesn't show dynamic libraries
I'm trying understand how some parts of a closed source program distributed as a stripped binary implemented. When I run ldd on the program, it prints only 4-5 most basic C libraries as dynamic ...
- 233
1
vote
2
answers
3k
views
How to verify that an Android Application & Library is correctly obfuscated
I have developed an Android Application with some data crunching inside a C library (NDK).
In order to protect the library code:
I have obfuscated the code with ProGuard and exported it in ...
- 11
1
vote
1
answer
106
views
How to insert arm instructions into a function in a native library?
I am new and am still learning assembly languuage. In a native android app library that has been disassembled i found this function which had 1 instruction.
addres hex arm instruction ...
- 164
1
vote
0
answers
192
views
Why rundll32.exe could be loading a DLL multiple times?
Since I started reverse engineering I've found multiple DLLs that when being debugged(IDA + WindDBG) would be unloaded and reloaded continuously without any evident reason.
Most of the time I use ...
- 11
1
vote
0
answers
82
views
Instruction-level hooking library for win32?
I am looking for instruction-level hooking library for win32 x86/x64.
I want to write hook insertion and hook implementation code in C/C++ (compiled into dll).
(Therefore instrumentation tools are ...
- 11
1
vote
0
answers
257
views
IDA shows MEMORY or unknown references on C std library calls (memset, memcpy, etc.)
I'm currently reversing a Linux 32-bit executable (with a statically linked library included in it) but I'm having a little problem I can't find a solution for.
Basically whenever I stumble across a ...
1
vote
0
answers
176
views
How to find implementation of native method in the library .so (Android)
I need to make reverse engineering of one android app.
In this app I found class with name Im2MessageNative, this class contains a lot of native methods.
For example:
static native long ...
1
vote
0
answers
485
views
Calling functions of a shared object (.so) extracted from an APK
Decompiling a regular Android application I noticed that its code uses some native functions. So, unpacking the (.apk) file I found the usual "lib" folder and under that a series of folders for ...
- 11
1
vote
0
answers
173
views
IDA Pro how debug constant function returning different results?
The code below is executed with the parameters (0, 4, 0) , the first 0 being an int pointer casted to an int, and these are the same every time. After execution, a 3 digit number string is returned/...
- 121
1
vote
0
answers
589
views
Android shared Library (.so)
I quite quite new to reverse engineering in General and there are a couple of things I'm unsure of. The app I am reverse engineering uses a couple of android libs in order to sign requests. So far I'...
- 31
0
votes
1
answer
525
views
ida identifies library function as regular function
I'm trying to find libc symbols in some Windows 32-bit application. For some reason, Ida autoanalysis didn't recognized code that comes from libc as "library function", but as a "regular function". ...
- 103
0
votes
2
answers
174
views
Antidebug/reverse engineering targeted for libraries [closed]
So I'm reading about antidebug and anti-reverse engineering techniques, but these cover, in all the docs I've seen, just executables.
Are there any resources that target specifically shared and ...
- 103
0
votes
1
answer
1k
views
How to view the functions of a loaded library in x64dbg
I am working on a packed file with UPX.
In one of the lines it calls to the value of the address 0xF5222C which is: 0x778057c0.
The debugger auto-completes it to kernel32.LoadLibraryA.
Where can I ...
- 573
-1
votes
1
answer
649
views
Fixing Indirect Jump as Call?
I have been using Ghidra to decompile a library. When I analyzed the decompiled version of a function, it resulted in this following output.
{
/* WARNING: Treating indirect jump ...
