Questions tagged [symbols]

Refer to a section of executable, library or object files that link memory addresses in the program and a string (the symbol). Symbols are used to store debug information, function names (for dynamic linking) and many other usages.

Filter by
Sorted by
Tagged with
1 vote
1 answer
48 views

How to load a PDB file into x64dbg?

I want to see symbols in the disassembly wherever possible, and I have a PDB file for the .exe I'm debugging, but I can't find a way to load the PDB file from disk. Is it even possible?
user avatar
2 votes
0 answers
30 views

How can I tell ld to link to a local symbol in a shared object?

Symbols in shared objects can be either local or global. This is controlled by a flag in the symbol table. If the symbol is local, ld won't resolve to it. Reverse engineering can often be aided by ...
user avatar
0 votes
0 answers
21 views

IDA doesn't create Elf32_Sym struct and thus no export for shared object dumped using Frida

I am reverse engineering a program which decrypts encrypted .so file runtime. It seems like they encrypt-decrypt only partially, because the decrypted file and encrypted file matches up to 0x4893D07. ...
user avatar
  • 165
2 votes
1 answer
81 views

Demangling symbols from green hills rh850 compiled binary

I have a binary compiled in Rh850 using green hills compiler from the looks. Luckily, it still symbols attached ,but I am struggling to read the symbols and it is worth my time to demangle them. Is ...
user avatar
  • 723
1 vote
2 answers
53 views

(Partial?) Automation of transferring symbol names between architectures

I have two versions of an app: one version compiled for ARM64 iOS, and the other for ARM32 Android. I'm working on the ARM64 version, but it has almost all of its symbols stripped. The ARM32 version ...
user avatar
1 vote
0 answers
253 views

Tool/parser for symbol tables produced with objdump -t to be used with IDA / Ghidra?

Working with a binary (arm64) file that seems to be some sort of a broken ELF file. The header data is missing and for some reason it contains a symbol table in a format that to me seem to be equal to ...
user avatar
0 votes
1 answer
91 views

Why might nm find a few undefined symbols that I can't see with xxd?

I'm cross-comparing a few approaches to testing for binaries that import a symbol and I noticed a YARA rule not finding one in sudo that nm + grep could find. I looked at it in xxd to figure out why, ...
user avatar
  • 103
2 votes
3 answers
420 views

Where Can I Get .PDB files for Windows OS Components?

I want to take a look at some components of the Windows OS in IDA, such as ntoskrnl.exe and some of the Windows API .DLLs. I understand there is a Microsoft symbol server, but I am not sure how to ...
user avatar
1 vote
0 answers
125 views

otool , nm, dsdump and jtool not able to list mach-o binary's symbols

I have encountered this twice recently where I am trying to list the external symbols for an iOS mach-o binary and none of the tools can provide any output. The following is an example of the output ...
user avatar
  • 95
0 votes
2 answers
188 views

How to retrieve name of a variable defined in the data segment in IDA when no process is attached?

I have disassembled an old DOS application with IDA. It run in 16-bit real mode. Some instructions are referencing variables defined in the data segment (DS). push word ptr ds:8401h Since I have ...
user avatar
  • 331
0 votes
1 answer
251 views

ida identifies library function as regular function

I'm trying to find libc symbols in some Windows 32-bit application. For some reason, Ida autoanalysis didn't recognized code that comes from libc as "library function", but as a "regular function". ...
user avatar
  • 103
1 vote
1 answer
799 views

IDA pro not showing function names properly

I am working with a C++ application in IDA and whenever I name a function with a :: or a ~ symbol it shows up in the function window as an underscore which is very hard to read (ex. Class::Function ...
user avatar
1 vote
0 answers
58 views

dwarf: variable offset from base

I have a simple code: int main() { int a = 4; printf("%d\n", a); a = 8; if (a == 8) printf("%d\n", a); return 0; } DIEs for the function and variable: <1><32a>: Abbrev ...
user avatar
  • 1,427
1 vote
1 answer
153 views

GCC is not recognizing symbol table in my hand-made ELF file

For learning purposes I've created (using a hex editor and some macros) the following ELF file: hello.o: ELF 64-bit LSB relocatable, x86-64, version 1 (SYSV), not stripped xxd hello.o: 00000000: ...
user avatar
1 vote
1 answer
1k views

IDA 7.0 (free) fails to load symbols with message "DWARF: Cannot determine location of DWARF info" during debugging

Here's the steps to repro. Just installed IDA (free) v.7.0 on a brand-new installation of Windows 10 (x64) in a VM: Then loaded a test PE file and started debugging it (using Local Windows Debugger): ...
user avatar
  • 1,275
2 votes
0 answers
1k views

How to add symbols from open source lib to Ghidra?

I have a binary which I can tell is using rapidjson (open source C++ library) (header only/not dynamically linked). How can I load debug symbols from that? It would help to see the types, function ...
user avatar
  • 121
3 votes
1 answer
9k views

How to configure IDA to load .pdb files from Microsoft public symbol server?

I've done this in one VM but I can't seem to replicate it in another. I'm using IDA to analyze a 32-bit Windows PE file. I then want to step thru it with a WinDbg debugger from within IDA. So when I ...
user avatar
  • 1,275
2 votes
1 answer
178 views

Missing Symbols RtlGetFrame, RtlPushFrame, RtlPopFrame

I'd like to use some undocumented symbols that listed in ProcessHacker project. taken from Here: https://github.com/processhacker/processhacker/blob/master/phnt/include/ntpebteb.h#L241 https://...
user avatar
  • 185
5 votes
1 answer
2k views

Find function in a stripped dynamic ELF library

Im currently reverse engineering an android app and this app calls a function named "getUserInfo" in an ARM 32bit ELF library called "libcms.so" (from TikTok) via the Java Native Interface. My ...
user avatar
3 votes
1 answer
700 views

How can you get the symbol visibility with radare?

I created a quick x86_64 Assembly file with NASM to generate the four different visibility classes for ELF 64. With readelf --symbols I get the Symbol Visibility in the Vis column: DEFAULT, INTERNAL, ...
user avatar
  • 1,614
1 vote
1 answer
655 views

How to find ELF symbol table reference?

In a huge ELF binary, I find some functions which use some kind of (string) constant. The constant itself seems to be stored inside the binary itself but I can't figure out, how to resolve IDA's ...
user avatar
  • 25
1 vote
1 answer
914 views

Radare can't seek to _start symbol

When I run is to show the symbols, I see [Symbols] 004 0x000000f0 0x006000f0 LOCAL NOTYPE 0 text1 005 0x000000cb 0x004000cb LOCAL NOTYPE 0 _print 006 0x000000d1 0x004000d1 LOCAL NOTYPE 0 ...
user avatar
  • 1,614
1 vote
3 answers
1k views

What is an "addend"?

From Learning Linux Binary Analysis by Ryan "elfmaster" O'Neill. On Page 32, the author states, The relocation records for 32-bit ELF files are the same as for 64-bit, but use 32-bit integers. The ...
user avatar
  • 1,614
1 vote
1 answer
1k views

How do you compile a C program with missing symbols?

In Learning Linux Binary Analysis by Ryan "elfmaster" O'Neill. On Page 33, the author compiles a program with a symbol reference and no definition, Let's take a look at the source code: _start() ...
user avatar
  • 1,614
1 vote
3 answers
386 views

What is the difference between a GLOBAL symbol and NONE?

I'm playing with a pe32 file. With is, Some of my symbols say GLOBAL others say NONE, 006 0x00027514 0x100428114 GLOBAL FUNC 0 k.exe_asdf .... 002 0x0002a808 0x10042c008 NONE FUNC 0 imp....
user avatar
  • 1,614
0 votes
1 answer
353 views

How to demangle symbols with starting with "@@"?

I'm looking at a PE binary which, given the names of some of the imported symbols, looks like it was built using the Delphi programming language. I'm basing this assumption on the symbols the binary ...
user avatar
2 votes
1 answer
2k views

How can I view the dynamic symbol table of a running process?

For any dynamic executable on Linux there is a dynamic linker that stores the current symbol bindings somewhere. So when a new library is loaded it knows whether to bind the symbol or not. For ...
user avatar
  • 151
2 votes
1 answer
2k views

Rebuilding a symbol table for a firmware binary

I am trying to reverse engineer the Linksys WAG120N router firmware. I've been able to unpack it and extract the bootloader, kernel and filesystem. The kernel is MIPS big endian. I loaded the kernel ...
user avatar
0 votes
1 answer
563 views

Why can't gdb find symbol which IDA can?

I was reversing this binary. While I tried to set a breakpoint in gdb on main function, it couldn't find its definition. Loading up the same binary in IDA shows up main method in the Function pane. ...
user avatar
3 votes
1 answer
446 views

Symbols visible in EXE file without PDB

I imported my exe file in OllyDB and when I searched for the names(labels) present, I was able to see all the function declarations, class names etc. I didn't have my PDB in the EXE path. Why does ...
user avatar
1 vote
1 answer
646 views

Relocate ELF symbols

How can I apply relocations of symbols in an elffile? I'm currently trying to archive this with pyelftools. Strangely, I could hardly find any information on how to do this, although some projects ...
user avatar
  • 2,806
0 votes
1 answer
127 views

Intel PIN and nm unable to capture binary symbols

I'm trying to generate a log of all identified symbols in a binary file. The application i'm trying to inspect is busybox. I've created a Pin Tool that successfully captures symbols (no demangling) ...
user avatar
3 votes
1 answer
883 views

Resolving symbols of statically linked libraries in a binary

assuming i got an statically linked libraries (for example, openssl) inside some binary. What is a good way to resolve the library symbols ? is there any IDA plugin for that job? I presume that I ...
user avatar
0 votes
2 answers
192 views

Which libraries exist for PDB (symbol file) generation?

I know that there are many libraries that parse PDB files and allow extracting debug information from them. For a project I am working on, I need to generate PDB files. Are there any publicly ...
user avatar
  • 1,469
4 votes
0 answers
328 views

Modern equivalent to rsymtab for reconstructing symbol table for statically linked / stripped binaries?

I'm working with a 32-bit ELF binary that (I believe) has been statically linked against a few different third-party libraries. It has also been stripped, so I don't have much to go on with respect to ...
user avatar
  • 41
1 vote
1 answer
2k views

How to get the recovered memory references in IDA-Pro? [duplicate]

I want to collect all the IDA recovered symbol information in data sections (this information could be function name, or it could be an entry of jump table, or it could be a reference to other data ...
user avatar
2 votes
1 answer
571 views

How can I obtain the data of how many memory references are symbolized by IDA-Pro?

We all know that in typical programs, there exist some references. When compiling, linker will translate all the memory references into concrete memory addresses during the symbol relocation step. ...
user avatar
1 vote
1 answer
214 views

Reuse symbols in disassembling/reassembling a C++ program

it's me again. I am working on a tool can that disassemble/reassemble stripped binaries and now I am sucked in a (external) symbol reuse issue. The test is on 32-bit Linux x86 platform. Suppose I ...
user avatar
13 votes
2 answers
5k views

In a Mach-O executable, how can I find which function a stub targets?

Before exposing my problem, here's my understanding of the whole thing, so that you may correct me if I'm saying something wrong. In a Mach-O file (at least on x86), the __TEXT.__stubs section ...
user avatar
  • 271
8 votes
2 answers
14k views

Why does `ldd` and `(gdb) info sharedlibrary` show a different library base address?

I see three different outputs for where libc should be loaded. ldd shows the loading address of libc at 0xf7e9e000 $ ldd ~/my_tool linux-gate.so.1 => (0xf7ffe000) libc.so.6 => /lib/...
user avatar
  • 2,849
1 vote
1 answer
374 views

How do I find non-exported symbols of a binary?

You can use nm(liux/mac) to find exported and imported functions/symbols, is it possible to find the non-exported symbols of a binary in a similar way? Are there command line tools to assist with this?...
user avatar
  • 11
1 vote
1 answer
2k views

How does IDA pro generate function names?

I am using IDA pro to decompile a series of applications. These applications share a common feature and what I have found is that in each decompilation each application shares the same set of ...
user avatar
  • 179
3 votes
1 answer
3k views

WinDbg Debugging without symbols

So I am trying to learn how to debug files that I don't have the symbol files for. The most common advice is to issue bp $exentry or bu @$exentry. However, neither of these work. Once I g the ...
user avatar
3 votes
1 answer
1k views

IDA fails to load Symbols from EXE on Linux

When I try to load a Portable Executable in IDA Pro 6.6 it can't resolve the Symbols. I have hooked it to a win32_remote.exe. It keeps saying E_PDB_NOT_FOUND. I even have WinDBG installed.
user avatar
  • 2,265
7 votes
3 answers
5k views

How to strip more than symbols?

I've noticed that, even after stripping symbols from my executable, class names and their methods are still included at the end of the executable file. For instance: #include <iostream> using ...
user avatar
9 votes
2 answers
2k views

Importing list of functions and addresses into WinDbg

When I have a kernel module without symbols, I'd typically first open it in IDA and give names to some of the subroutines (those I'm interested in). Since I prefer my kernel debugging with plain ...
user avatar
  • 193
3 votes
2 answers
4k views

How to determine if binary has symbol table

Is there a practical way to find if the raw binary (firmware image for example) has symbol table ? Finding start or end of it ? And if it exists is it a single block or can it be seperate multiple ...
user avatar
5 votes
1 answer
2k views

Load dSYM symbols in Hopper

Can I load dSYM symbols into Hopper? (I searched extensively in the menus etc. but couldn't find such an option) Context: I want to see how a program I created using Xcode was compiled into machine ...
user avatar
  • 157
-2 votes
1 answer
2k views

How can I locate exported functions of an EXE or DLL? [closed]

I am trying to do some experimenting with certain system files (DLLs, EXEs) in Windows and would like to know how I can get information about the functions that they contain. I want to be able to call ...
user avatar
11 votes
3 answers
4k views

Hooking functions in Linux and/or OSX?

I want to hook functions in a library (lib.so or lib.dylib) from another process. I know that unlike windows libraries, libraries in Linux and Mac still have their symbols (function names and ...
user avatar
  • 111