Questions tagged [symbols]
Refer to a section of executable, library or object files that link memory addresses in the program and a string (the symbol). Symbols are used to store debug information, function names (for dynamic linking) and many other usages.
57
questions
0
votes
2
answers
64
views
How does IDA know the symbol names for classes and interfaces?
I am reversing a 32 bit library used by a Linux game (I am sure someone might recognize the engine used). I was messing around with cutter and when trying to compare it to IDA, which I have used in ...
- 103
0
votes
0
answers
29
views
windbg fail to load symbol with UNC store
I'm debugging a qemu windows machine in docker and the windbg shows the file is missing. Windbg is attached to qemu
kd> .sympath
Symbol search path is: srv*
Expanded Symbol search path is: cache*;...
- 301
3
votes
0
answers
185
views
How to force IDA to load MFC DLL symbols while disassembling an EXE that uses such DLL?
I found that IDA may not load symbols for MFC DLLs while disassembling EXEs that load such DLLs. This makes the disassembling horrible if the DLL is linked just by ordinals, and IDA doesn't have a ...
2
votes
0
answers
109
views
How to get the address of a glibc private symbol at runtime programmatically?
I am trying to get the address of a private function in GLIBC.
For instance - the function __run_prefork_handlers().
I have done it with gdb, using info symbol __run_prefork_handlers and info address ...
- 121
1
vote
0
answers
64
views
determine the PC of code gadgets in PLT section of ELF file
I am trying to parse an ELF file using custom code. With reference to the image below (output displayed is from objdump), I need to get the address of code gadget starting at , for example 401030 for ...
- 11
2
votes
0
answers
240
views
What is the correct way to load pdb symbols to show the functions by their name instead of their addresses in x64dbg?
I am trying to reverse a portion of a game, that game loads a DLL file called "ddraw.dll".
Most of the DLL file functions don't appear by their names but appear by their addresses
for ...
- 269
2
votes
1
answer
2k
views
How to load a PDB file into x64dbg?
I want to see symbols in the disassembly wherever possible, and I have a PDB file for the .exe I'm debugging, but I can't find a way to load the PDB file from disk. Is it even possible?
- 167
2
votes
0
answers
226
views
How can I tell ld to link to a local symbol in a shared object?
Symbols in shared objects can be either local or global. This is controlled by a flag in the symbol table. If the symbol is local, ld won't resolve to it.
Reverse engineering can often be aided by ...
- 187
2
votes
1
answer
183
views
Demangling symbols from green hills rh850 compiled binary
I have a binary compiled in Rh850 using green hills compiler from the looks. Luckily, it still symbols attached ,but I am struggling to read the symbols and it is worth my time to demangle them. Is ...
- 773
1
vote
2
answers
60
views
(Partial?) Automation of transferring symbol names between architectures
I have two versions of an app: one version compiled for ARM64 iOS, and the other for ARM32 Android. I'm working on the ARM64 version, but it has almost all of its symbols stripped. The ARM32 version ...
- 23
2
votes
0
answers
567
views
Tool/parser for symbol tables produced with objdump -t to be used with IDA / Ghidra?
Working with a binary (arm64) file that seems to be some sort of a broken ELF file. The header data is missing and for some reason it contains a symbol table in a format that to me seem to be equal to ...
- 121
0
votes
1
answer
414
views
Why might nm find a few undefined symbols that I can't see with xxd?
I'm cross-comparing a few approaches to testing for binaries that import a symbol and I noticed a YARA rule not finding one in sudo that nm + grep could find.
I looked at it in xxd to figure out why, ...
- 103
3
votes
3
answers
1k
views
Where Can I Get .PDB files for Windows OS Components?
I want to take a look at some components of the Windows OS in IDA, such as ntoskrnl.exe and some of the Windows API .DLLs. I understand there is a Microsoft symbol server, but I am not sure how to ...
- 151
1
vote
0
answers
230
views
otool , nm, dsdump and jtool not able to list mach-o binary's symbols
I have encountered this twice recently where I am trying to list the external symbols for an iOS mach-o binary and none of the tools can provide any output. The following is an example of the output ...
- 167
0
votes
2
answers
333
views
How to retrieve name of a variable defined in the data segment in IDA when no process is attached?
I have disassembled an old DOS application with IDA. It run in 16-bit real mode. Some instructions are referencing variables defined in the data segment (DS).
push word ptr ds:8401h
Since I have ...
- 371
0
votes
1
answer
613
views
ida identifies library function as regular function
I'm trying to find libc symbols in some Windows 32-bit application. For some reason, Ida autoanalysis didn't recognized code that comes from libc as "library function", but as a "regular function". ...
- 103
1
vote
1
answer
1k
views
IDA pro not showing function names properly
I am working with a C++ application in IDA and whenever I name a function with a :: or a ~ symbol it shows up in the function window as an underscore which is very hard to read (ex. Class::Function ...
- 11
1
vote
0
answers
122
views
dwarf: variable offset from base
I have a simple code:
int main()
{
int a = 4;
printf("%d\n", a);
a = 8;
if (a == 8)
printf("%d\n", a);
return 0;
}
DIEs for the function and variable:
<1><32a>: Abbrev ...
- 1,767
1
vote
1
answer
242
views
GCC is not recognizing symbol table in my hand-made ELF file
For learning purposes I've created (using a hex editor and some macros) the following ELF file:
hello.o: ELF 64-bit LSB relocatable, x86-64, version 1 (SYSV), not stripped
xxd hello.o:
00000000: ...
- 11
1
vote
2
answers
2k
views
IDA 7.0 (free) fails to load symbols with message "DWARF: Cannot determine location of DWARF info" during debugging
Here's the steps to repro. Just installed IDA (free) v.7.0 on a brand-new installation of Windows 10 (x64) in a VM:
Then loaded a test PE file and started debugging it (using Local Windows Debugger):
...
- 1,517
2
votes
0
answers
2k
views
How to add symbols from open source lib to Ghidra?
I have a binary which I can tell is using rapidjson (open source C++ library) (header only/not dynamically linked). How can I load debug symbols from that? It would help to see the types, function ...
- 121
3
votes
1
answer
12k
views
How to configure IDA to load .pdb files from Microsoft public symbol server?
I've done this in one VM but I can't seem to replicate it in another. I'm using IDA to analyze a 32-bit Windows PE file. I then want to step thru it with a WinDbg debugger from within IDA.
So when I ...
- 1,517
2
votes
1
answer
240
views
Missing Symbols RtlGetFrame, RtlPushFrame, RtlPopFrame
I'd like to use some undocumented symbols that listed in ProcessHacker project. taken from Here:
https://github.com/processhacker/processhacker/blob/master/phnt/include/ntpebteb.h#L241
https://...
- 205
5
votes
1
answer
2k
views
Find function in a stripped dynamic ELF library
Im currently reverse engineering an android app and this app calls a function named "getUserInfo" in an ARM 32bit ELF library called "libcms.so" (from TikTok) via the Java Native Interface.
My ...
- 153
3
votes
1
answer
1k
views
How can you get the symbol visibility with radare?
I created a quick x86_64 Assembly file with NASM to generate the four different visibility classes for ELF 64. With readelf --symbols I get the Symbol Visibility in the Vis column: DEFAULT, INTERNAL, ...
- 1,769
1
vote
1
answer
937
views
How to find ELF symbol table reference?
In a huge ELF binary, I find some functions which use some kind of (string) constant. The constant itself seems to be stored inside the binary itself but I can't figure out, how to resolve IDA's ...
- 25
1
vote
1
answer
1k
views
Radare can't seek to _start symbol
When I run is to show the symbols, I see
[Symbols]
004 0x000000f0 0x006000f0 LOCAL NOTYPE 0 text1
005 0x000000cb 0x004000cb LOCAL NOTYPE 0 _print
006 0x000000d1 0x004000d1 LOCAL NOTYPE 0 ...
- 1,769
1
vote
3
answers
2k
views
What is an "addend"?
From Learning Linux Binary Analysis by Ryan "elfmaster" O'Neill. On Page 32, the author states,
The relocation records for 32-bit ELF files are the same as for 64-bit, but use 32-bit integers. The ...
- 1,769
1
vote
1
answer
1k
views
How do you compile a C program with missing symbols?
In Learning Linux Binary Analysis by Ryan "elfmaster" O'Neill. On Page 33, the author compiles a program with a symbol reference and no definition,
Let's take a look at the source code:
_start()
...
- 1,769
1
vote
3
answers
469
views
What is the difference between a GLOBAL symbol and NONE?
I'm playing with a pe32 file. With is, Some of my symbols say GLOBAL others say NONE,
006 0x00027514 0x100428114 GLOBAL FUNC 0 k.exe_asdf
....
002 0x0002a808 0x10042c008 NONE FUNC 0 imp....
- 1,769
0
votes
1
answer
468
views
How to demangle symbols with starting with "@@"?
I'm looking at a PE binary which, given the names of some of the imported symbols, looks like it was built using the Delphi programming language. I'm basing this assumption on the symbols the binary ...
- 1,060
3
votes
1
answer
2k
views
How can I view the dynamic symbol table of a running process?
For any dynamic executable on Linux there is a dynamic linker that stores the current symbol bindings somewhere. So when a new library is loaded it knows whether to bind the symbol or not.
For ...
- 161
2
votes
1
answer
2k
views
Rebuilding a symbol table for a firmware binary
I am trying to reverse engineer the Linksys WAG120N router firmware. I've been able to unpack it and extract the bootloader, kernel and filesystem.
The kernel is MIPS big endian. I loaded the kernel ...
- 203
0
votes
1
answer
642
views
Why can't gdb find symbol which IDA can?
I was reversing this binary. While I tried to set a breakpoint in gdb on main function, it couldn't find its definition. Loading up the same binary in IDA shows up main method in the Function pane. ...
- 1,351
3
votes
1
answer
524
views
Symbols visible in EXE file without PDB
I imported my exe file in OllyDB and when I searched for the names(labels) present, I was able to see all the function declarations, class names etc. I didn't have my PDB in the EXE path. Why does ...
1
vote
1
answer
725
views
Relocate ELF symbols
How can I apply relocations of symbols in an elffile? I'm currently trying to archive this with pyelftools. Strangely, I could hardly find any information on how to do this, although some projects ...
- 2,896
0
votes
1
answer
151
views
Intel PIN and nm unable to capture binary symbols
I'm trying to generate a log of all identified symbols in a binary file. The application i'm trying to inspect is busybox. I've created a Pin Tool that successfully captures symbols (no demangling) ...
3
votes
1
answer
1k
views
Resolving symbols of statically linked libraries in a binary
assuming i got an statically linked libraries (for example, openssl) inside some binary.
What is a good way to resolve the library symbols ? is there any IDA plugin for that job?
I presume that I ...
- 31
0
votes
2
answers
242
views
Which libraries exist for PDB (symbol file) generation?
I know that there are many libraries that parse PDB files and allow extracting debug information from them.
For a project I am working on, I need to generate PDB files. Are there any publicly ...
- 1,557
4
votes
0
answers
340
views
Modern equivalent to rsymtab for reconstructing symbol table for statically linked / stripped binaries?
I'm working with a 32-bit ELF binary that (I believe) has been statically linked against a few different third-party libraries. It has also been stripped, so I don't have much to go on with respect to ...
- 91
1
vote
1
answer
2k
views
How to get the recovered memory references in IDA-Pro? [duplicate]
I want to collect all the IDA recovered symbol information in data sections (this information could be function name, or it could be an entry of jump table, or it could be a reference to other data ...
- 2,465
2
votes
1
answer
678
views
How can I obtain the data of how many memory references are symbolized by IDA-Pro?
We all know that in typical programs, there exist some references.
When compiling, linker will translate all the memory references into concrete memory addresses during the symbol relocation step. ...
- 2,465
1
vote
1
answer
278
views
Reuse symbols in disassembling/reassembling a C++ program
it's me again. I am working on a tool can that disassemble/reassemble stripped binaries and now I am sucked in a (external) symbol reuse issue.
The test is on 32-bit Linux x86 platform.
Suppose I ...
- 2,465
16
votes
2
answers
6k
views
In a Mach-O executable, how can I find which function a stub targets?
Before exposing my problem, here's my understanding of the whole thing, so that you may correct me if I'm saying something wrong.
In a Mach-O file (at least on x86), the __TEXT.__stubs section ...
- 321
9
votes
2
answers
15k
views
Why does `ldd` and `(gdb) info sharedlibrary` show a different library base address?
I see three different outputs for where libc should be loaded.
ldd shows the loading address of libc at 0xf7e9e000
$ ldd ~/my_tool
linux-gate.so.1 => (0xf7ffe000)
libc.so.6 => /lib/...
- 3,059
1
vote
1
answer
418
views
How do I find non-exported symbols of a binary?
You can use nm(liux/mac) to find exported and imported functions/symbols, is it possible to find the non-exported symbols of a binary in a similar way? Are there command line tools to assist with this?...
- 11
1
vote
1
answer
2k
views
How does IDA pro generate function names?
I am using IDA pro to decompile a series of applications. These applications share a common feature and what I have found is that in each decompilation each application shares the same set of ...
- 179
3
votes
1
answer
3k
views
WinDbg Debugging without symbols
So I am trying to learn how to debug files that I don't have the symbol files for. The most common advice is to issue bp $exentry or bu @$exentry. However, neither of these work. Once I g the ...
- 665
3
votes
1
answer
1k
views
IDA fails to load Symbols from EXE on Linux
When I try to load a Portable Executable in IDA Pro 6.6 it can't resolve the Symbols. I have hooked it to a win32_remote.exe. It keeps saying E_PDB_NOT_FOUND.
I even have WinDBG installed.
- 2,321
7
votes
3
answers
5k
views
How to strip more than symbols?
I've noticed that, even after stripping symbols from my executable, class names and their methods are still included at the end of the executable file.
For instance:
#include <iostream>
using ...
user2005