Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [symbols]

Refer to a section of executable, library or object files that link memory addresses in the program and a string (the symbol). Symbols are used to store debug information, function names (for dynamic linking) and many other usages.

0
votes
0answers
23 views

Does Radare offer the ability to invoke the linker and disassemble a function (import or reloc)?

Sometimes I'm doing static analysis outside of the debugger, and I want to see what a function that a symbol points to will do after the linker does runtime relocation. All I see in the disassembly is ...
2
votes
1answer
66 views

How can you get the symbol visibility with radare?

I created a quick x86_64 Assembly file with NASM to generate the four different visibility classes for ELF 64. With readelf --symbols I get the Symbol Visibility in the Vis column: DEFAULT, INTERNAL, ...
1
vote
1answer
212 views

How to find ELF symbol table reference?

In a huge ELF binary, I find some functions which use some kind of (string) constant. The constant itself seems to be stored inside the binary itself but I can't figure out, how to resolve IDA's ...
0
votes
1answer
189 views

Radare can't seek to _start symbol

When I run is to show the symbols, I see [Symbols] 004 0x000000f0 0x006000f0 LOCAL NOTYPE 0 text1 005 0x000000cb 0x004000cb LOCAL NOTYPE 0 _print 006 0x000000d1 0x004000d1 LOCAL NOTYPE 0 ...
-1
votes
1answer
81 views

What is an “addend”?

From Learning Linux Binary Analysis by Ryan "elfmaster" O'Neill. On Page 32, the author states, The relocation records for 32-bit ELF files are the same as for 64-bit, but use 32-bit integers. The ...
1
vote
1answer
174 views

How do you compile a C program with missing symbols?

In Learning Linux Binary Analysis by Ryan "elfmaster" O'Neill. On Page 33, the author compiles a program with a symbol reference and no definition, Let's take a look at the source code: _start() ...
1
vote
3answers
86 views

What is the difference between a GLOBAL symbol and NONE?

I'm playing with a pe32 file. With is, Some of my symbols say GLOBAL others say NONE, 006 0x00027514 0x100428114 GLOBAL FUNC 0 k.exe_asdf .... 002 0x0002a808 0x10042c008 NONE FUNC 0 imp....
0
votes
0answers
199 views

dumpbin /DISASM doesn't show symbol names

dumpbin /DISASM has trouble resolving function names and instead only displays addresses: 000000014016D68E: E8 1D 24 00 00 call 000000014016FAB0 000000014016D693: EB 3C jmp ...
0
votes
1answer
114 views

How to demangle symbols with starting with “@@”?

I'm looking at a PE binary which, given the names of some of the imported symbols, looks like it was built using the Delphi programming language. I'm basing this assumption on the symbols the binary ...
2
votes
1answer
576 views

How can I view the dynamic symbol table of a running process?

For any dynamic executable on Linux there is a dynamic linker that stores the current symbol bindings somewhere. So when a new library is loaded it knows whether to bind the symbol or not. For ...
1
vote
1answer
660 views

Rebuilding a symbol table for a firmware binary

I am trying to reverse engineer the Linksys WAG120N router firmware. I've been able to unpack it and extract the bootloader, kernel and filesystem. The kernel is MIPS big endian. I loaded the kernel ...
0
votes
1answer
231 views

Why can't gdb find symbol which IDA can?

I was reversing this binary. While I tried to set a breakpoint in gdb on main function, it couldn't find its definition. Loading up the same binary in IDA shows up main method in the Function pane. ...
3
votes
1answer
276 views

Symbols visible in EXE file without PDB

I imported my exe file in OllyDB and when I searched for the names(labels) present, I was able to see all the function declarations, class names etc. I didn't have my PDB in the EXE path. Why does ...
1
vote
1answer
431 views

Relocate ELF symbols

How can I apply relocations of symbols in an elffile? I'm currently trying to archive this with pyelftools. Strangely, I could hardly find any information on how to do this, although some projects ...
0
votes
1answer
83 views

Intel PIN and nm unable to capture binary symbols

I'm trying to generate a log of all identified symbols in a binary file. The application i'm trying to inspect is busybox. I've created a Pin Tool that successfully captures symbols (no demangling) ...
3
votes
1answer
486 views

Resolving symbols of statically linked libraries in a binary

assuming i got an statically linked libraries (for example, openssl) inside some binary. What is a good way to resolve the library symbols ? is there any IDA plugin for that job? I presume that I ...
0
votes
2answers
141 views

Which libraries exist for PDB (symbol file) generation?

I know that there are many libraries that parse PDB files and allow extracting debug information from them. For a project I am working on, I need to generate PDB files. Are there any publicly ...
2
votes
0answers
227 views

Modern equivalent to rsymtab for reconstructing symbol table for statically linked / stripped binaries?

I'm working with a 32-bit ELF binary that (I believe) has been statically linked against a few different third-party libraries. It has also been stripped, so I don't have much to go on with respect to ...
1
vote
1answer
1k views

How to get the recovered memory references in IDA-Pro? [duplicate]

I want to collect all the IDA recovered symbol information in data sections (this information could be function name, or it could be an entry of jump table, or it could be a reference to other data ...
2
votes
2answers
287 views

How can I obtain the data of how many memory references are symbolized by IDA-Pro?

We all know that in typical programs, there exist some references. When compiling, linker will translate all the memory references into concrete memory addresses during the symbol relocation step. ...
1
vote
1answer
148 views

Reuse symbols in disassembling/reassembling a C++ program

it's me again. I am working on a tool can that disassemble/reassemble stripped binaries and now I am sucked in a (external) symbol reuse issue. The test is on 32-bit Linux x86 platform. Suppose I ...
6
votes
2answers
3k views

In a Mach-O executable, how can I find which function a stub targets?

Before exposing my problem, here's my understanding of the whole thing, so that you may correct me if I'm saying something wrong. In a Mach-O file (at least on x86), the __TEXT.__stubs section ...
7
votes
2answers
8k views

Why does `ldd` and `(gdb) info sharedlibrary` show a different library base address?

I see three different outputs for where libc should be loaded. ldd shows the loading address of libc at 0xf7e9e000 $ ldd ~/my_tool linux-gate.so.1 => (0xf7ffe000) libc.so.6 => /lib/...
1
vote
1answer
309 views

How do I find non-exported symbols of a binary?

You can use nm(liux/mac) to find exported and imported functions/symbols, is it possible to find the non-exported symbols of a binary in a similar way? Are there command line tools to assist with this?...
1
vote
1answer
1k views

How does IDA pro generate function names?

I am using IDA pro to decompile a series of applications. These applications share a common feature and what I have found is that in each decompilation each application shares the same set of ...
2
votes
1answer
2k views

WinDbg Debugging without symbols

So I am trying to learn how to debug files that I don't have the symbol files for. The most common advice is to issue bp $exentry or bu @$exentry. However, neither of these work. Once I g the ...
3
votes
1answer
854 views

IDA fails to load Symbols from EXE on Linux

When I try to load a Portable Executable in IDA Pro 6.6 it can't resolve the Symbols. I have hooked it to a win32_remote.exe. It keeps saying E_PDB_NOT_FOUND. I even have WinDBG installed.
6
votes
3answers
1k views

How to strip more than symbols?

I've noticed that, even after stripping symbols from my executable, class names and their methods are still included at the end of the executable file. For instance: #include <iostream> using ...
8
votes
1answer
2k views

Importing list of functions and addresses into WinDbg

When I have a kernel module without symbols, I'd typically first open it in IDA and give names to some of the subroutines (those I'm interested in). Since I prefer my kernel debugging with plain ...
3
votes
2answers
2k views

How to determine if binary has symbol table

Is there a practical way to find if the raw binary (firmware image for example) has symbol table ? Finding start or end of it ? And if it exists is it a single block or can it be seperate multiple ...
4
votes
1answer
790 views

Load dSYM symbols in Hopper

Can I load dSYM symbols into Hopper? (I searched extensively in the menus etc. but couldn't find such an option) Context: I want to see how a program I created using Xcode was compiled into machine ...
-2
votes
1answer
1k views

How can I locate exported functions of an EXE or DLL? [closed]

I am trying to do some experimenting with certain system files (DLLs, EXEs) in Windows and would like to know how I can get information about the functions that they contain. I want to be able to call ...
10
votes
3answers
3k views

Hooking functions in Linux and/or OSX?

I want to hook functions in a library (lib.so or lib.dylib) from another process. I know that unlike windows libraries, libraries in linux and mac still have their symbols (function names and ...
20
votes
3answers
8k views

Can I statically link (not import) the Windows system DLLs?

I have compiled following C source code in VS2010 console project. #include <stdio.h> int main(int argc, char* argv[]){ printf("hello world\n"); return 0; } then I used /MT option for ...
28
votes
1answer
5k views

What kinds of steps can I take to make my C++ application harder to reverse engineer?

If I am building a C++ application and I want to make it more difficult to reverse engineer, what steps can I take to do this? Does the choice of compiler affect this? What about compiler flags, ...