Questions tagged [symbols]

Refer to a section of executable, library or object files that link memory addresses in the program and a string (the symbol). Symbols are used to store debug information, function names (for dynamic linking) and many other usages.

Filter by
Sorted by
Tagged with
0 votes
0 answers
32 views

Symbols in Ghidra based on r/w possible?

Is it possible to have a symbol file with different names for an address based on whether a instruction is accessing the address read or write? For example, I have a hardware address $FF8800 for a ...
Trevor Acton's user avatar
1 vote
1 answer
86 views

Where is IDA getting this symbol?

I'm currently researching how a certain malware works and patches some stuff in a certain Android's library. Inspecting the library -which is stripped- in IDA I was able to get the symbol for a ...
Arget's user avatar
  • 13
0 votes
2 answers
145 views

How does IDA know the symbol names for classes and interfaces?

I am reversing a 32 bit library used by a Linux game (I am sure someone might recognize the engine used). I was messing around with cutter and when trying to compare it to IDA, which I have used in ...
trxgnyp1's user avatar
  • 103
0 votes
0 answers
114 views

windbg fail to load symbol with UNC store

I'm debugging a qemu windows machine in docker and the windbg shows the file is missing. Windbg is attached to qemu kd> .sympath Symbol search path is: srv* Expanded Symbol search path is: cache*;...
anonymous bear's user avatar
3 votes
0 answers
336 views

How to force IDA to load MFC DLL symbols while disassembling an EXE that uses such DLL?

I found that IDA may not load symbols for MFC DLLs while disassembling EXEs that load such DLLs. This makes the disassembling horrible if the DLL is linked just by ordinals, and IDA doesn't have a ...
Eugene Muzychenko's user avatar
2 votes
0 answers
171 views

How to get the address of a glibc private symbol at runtime programmatically?

I am trying to get the address of a private function in GLIBC. For instance - the function __run_prefork_handlers(). I have done it with gdb, using info symbol __run_prefork_handlers and info address ...
joepol's user avatar
  • 121
1 vote
0 answers
90 views

determine the PC of code gadgets in PLT section of ELF file

I am trying to parse an ELF file using custom code. With reference to the image below (output displayed is from objdump), I need to get the address of code gadget starting at , for example 401030 for ...
Mahwish's user avatar
  • 11
2 votes
0 answers
385 views

What is the correct way to load pdb symbols to show the functions by their name instead of their addresses in x64dbg?

I am trying to reverse a portion of a game, that game loads a DLL file called "ddraw.dll". Most of the DLL file functions don't appear by their names but appear by their addresses for ...
Lion King's user avatar
  • 269
3 votes
1 answer
3k views

How to load a PDB file into x64dbg?

I want to see symbols in the disassembly wherever possible, and I have a PDB file for the .exe I'm debugging, but I can't find a way to load the PDB file from disk. Is it even possible?
Violet Giraffe's user avatar
2 votes
0 answers
326 views

How can I tell ld to link to a local symbol in a shared object?

Symbols in shared objects can be either local or global. This is controlled by a flag in the symbol table. If the symbol is local, ld won't resolve to it. Reverse engineering can often be aided by ...
SRobertJames's user avatar
2 votes
1 answer
219 views

Demangling symbols from green hills rh850 compiled binary

I have a binary compiled in Rh850 using green hills compiler from the looks. Luckily, it still symbols attached ,but I am struggling to read the symbols and it is worth my time to demangle them. Is ...
LUser's user avatar
  • 783
1 vote
2 answers
60 views

(Partial?) Automation of transferring symbol names between architectures

I have two versions of an app: one version compiled for ARM64 iOS, and the other for ARM32 Android. I'm working on the ARM64 version, but it has almost all of its symbols stripped. The ARM32 version ...
squ1dd13's user avatar
2 votes
0 answers
639 views

Tool/parser for symbol tables produced with objdump -t to be used with IDA / Ghidra?

Working with a binary (arm64) file that seems to be some sort of a broken ELF file. The header data is missing and for some reason it contains a symbol table in a format that to me seem to be equal to ...
blubbafett's user avatar
0 votes
1 answer
544 views

Why might nm find a few undefined symbols that I can't see with xxd?

I'm cross-comparing a few approaches to testing for binaries that import a symbol and I noticed a YARA rule not finding one in sudo that nm + grep could find. I looked at it in xxd to figure out why, ...
abathur's user avatar
  • 103
3 votes
3 answers
2k views

Where Can I Get .PDB files for Windows OS Components?

I want to take a look at some components of the Windows OS in IDA, such as ntoskrnl.exe and some of the Windows API .DLLs. I understand there is a Microsoft symbol server, but I am not sure how to ...
Invalidation's user avatar
1 vote
0 answers
296 views

otool , nm, dsdump and jtool not able to list mach-o binary's symbols

I have encountered this twice recently where I am trying to list the external symbols for an iOS mach-o binary and none of the tools can provide any output. The following is an example of the output ...
Jon's user avatar
  • 167
0 votes
2 answers
410 views

How to retrieve name of a variable defined in the data segment in IDA when no process is attached?

I have disassembled an old DOS application with IDA. It run in 16-bit real mode. Some instructions are referencing variables defined in the data segment (DS). push word ptr ds:8401h Since I have ...
tigrou's user avatar
  • 371
0 votes
1 answer
724 views

ida identifies library function as regular function

I'm trying to find libc symbols in some Windows 32-bit application. For some reason, Ida autoanalysis didn't recognized code that comes from libc as "library function", but as a "regular function". ...
Z E Nir's user avatar
  • 103
1 vote
1 answer
2k views

IDA pro not showing function names properly

I am working with a C++ application in IDA and whenever I name a function with a :: or a ~ symbol it shows up in the function window as an underscore which is very hard to read (ex. Class::Function ...
username3630's user avatar
1 vote
0 answers
136 views

dwarf: variable offset from base

I have a simple code: int main() { int a = 4; printf("%d\n", a); a = 8; if (a == 8) printf("%d\n", a); return 0; } DIEs for the function and variable: <1><32a>: Abbrev ...
R4444's user avatar
  • 1,797
1 vote
1 answer
261 views

GCC is not recognizing symbol table in my hand-made ELF file

For learning purposes I've created (using a hex editor and some macros) the following ELF file: hello.o: ELF 64-bit LSB relocatable, x86-64, version 1 (SYSV), not stripped xxd hello.o: 00000000: ...
PhilipRoman's user avatar
1 vote
2 answers
2k views

IDA 7.0 (free) fails to load symbols with message "DWARF: Cannot determine location of DWARF info" during debugging

Here's the steps to repro. Just installed IDA (free) v.7.0 on a brand-new installation of Windows 10 (x64) in a VM: Then loaded a test PE file and started debugging it (using Local Windows Debugger): ...
c00000fd's user avatar
  • 1,649
2 votes
0 answers
2k views

How to add symbols from open source lib to Ghidra?

I have a binary which I can tell is using rapidjson (open source C++ library) (header only/not dynamically linked). How can I load debug symbols from that? It would help to see the types, function ...
zelcon's user avatar
  • 121
3 votes
1 answer
13k views

How to configure IDA to load .pdb files from Microsoft public symbol server?

I've done this in one VM but I can't seem to replicate it in another. I'm using IDA to analyze a 32-bit Windows PE file. I then want to step thru it with a WinDbg debugger from within IDA. So when I ...
c00000fd's user avatar
  • 1,649
2 votes
1 answer
253 views

Missing Symbols RtlGetFrame, RtlPushFrame, RtlPopFrame

I'd like to use some undocumented symbols that listed in ProcessHacker project. taken from Here: https://github.com/processhacker/processhacker/blob/master/phnt/include/ntpebteb.h#L241 https://...
Irad K's user avatar
  • 205
5 votes
1 answer
2k views

Find function in a stripped dynamic ELF library

Im currently reverse engineering an android app and this app calls a function named "getUserInfo" in an ARM 32bit ELF library called "libcms.so" (from TikTok) via the Java Native Interface. My ...
SinOfficial's user avatar
3 votes
1 answer
1k views

How can you get the symbol visibility with radare?

I created a quick x86_64 Assembly file with NASM to generate the four different visibility classes for ELF 64. With readelf --symbols I get the Symbol Visibility in the Vis column: DEFAULT, INTERNAL, ...
Evan Carroll's user avatar
  • 1,779
1 vote
1 answer
1k views

How to find ELF symbol table reference?

In a huge ELF binary, I find some functions which use some kind of (string) constant. The constant itself seems to be stored inside the binary itself but I can't figure out, how to resolve IDA's ...
oxident's user avatar
  • 25
1 vote
1 answer
1k views

Radare can't seek to _start symbol

When I run is to show the symbols, I see [Symbols] 004 0x000000f0 0x006000f0 LOCAL NOTYPE 0 text1 005 0x000000cb 0x004000cb LOCAL NOTYPE 0 _print 006 0x000000d1 0x004000d1 LOCAL NOTYPE 0 ...
Evan Carroll's user avatar
  • 1,779
1 vote
3 answers
2k views

What is an "addend"?

From Learning Linux Binary Analysis by Ryan "elfmaster" O'Neill. On Page 32, the author states, The relocation records for 32-bit ELF files are the same as for 64-bit, but use 32-bit integers. The ...
Evan Carroll's user avatar
  • 1,779
1 vote
1 answer
2k views

How do you compile a C program with missing symbols?

In Learning Linux Binary Analysis by Ryan "elfmaster" O'Neill. On Page 33, the author compiles a program with a symbol reference and no definition, Let's take a look at the source code: _start() ...
Evan Carroll's user avatar
  • 1,779
1 vote
3 answers
502 views

What is the difference between a GLOBAL symbol and NONE?

I'm playing with a pe32 file. With is, Some of my symbols say GLOBAL others say NONE, 006 0x00027514 0x100428114 GLOBAL FUNC 0 k.exe_asdf .... 002 0x0002a808 0x10042c008 NONE FUNC 0 imp....
Evan Carroll's user avatar
  • 1,779
0 votes
1 answer
503 views

How to demangle symbols with starting with "@@"?

I'm looking at a PE binary which, given the names of some of the imported symbols, looks like it was built using the Delphi programming language. I'm basing this assumption on the symbols the binary ...
John Källén's user avatar
4 votes
1 answer
2k views

How can I view the dynamic symbol table of a running process?

For any dynamic executable on Linux there is a dynamic linker that stores the current symbol bindings somewhere. So when a new library is loaded it knows whether to bind the symbol or not. For ...
Calmarius's user avatar
  • 171
2 votes
1 answer
2k views

Rebuilding a symbol table for a firmware binary

I am trying to reverse engineer the Linksys WAG120N router firmware. I've been able to unpack it and extract the bootloader, kernel and filesystem. The kernel is MIPS big endian. I loaded the kernel ...
Aaron Garton's user avatar
0 votes
1 answer
665 views

Why can't gdb find symbol which IDA can?

I was reversing this binary. While I tried to set a breakpoint in gdb on main function, it couldn't find its definition. Loading up the same binary in IDA shows up main method in the Function pane. ...
sherlock's user avatar
  • 1,371
3 votes
1 answer
546 views

Symbols visible in EXE file without PDB

I imported my exe file in OllyDB and when I searched for the names(labels) present, I was able to see all the function declarations, class names etc. I didn't have my PDB in the EXE path. Why does ...
Kaushik Ramachandran's user avatar
1 vote
1 answer
749 views

Relocate ELF symbols

How can I apply relocations of symbols in an elffile? I'm currently trying to archive this with pyelftools. Strangely, I could hardly find any information on how to do this, although some projects ...
Nordwald's user avatar
  • 2,896
0 votes
1 answer
155 views

Intel PIN and nm unable to capture binary symbols

I'm trying to generate a log of all identified symbols in a binary file. The application i'm trying to inspect is busybox. I've created a Pin Tool that successfully captures symbols (no demangling) ...
Gabriel Vasconcelos's user avatar
3 votes
1 answer
1k views

Resolving symbols of statically linked libraries in a binary

assuming i got an statically linked libraries (for example, openssl) inside some binary. What is a good way to resolve the library symbols ? is there any IDA plugin for that job? I presume that I ...
Analyzer's user avatar
0 votes
2 answers
250 views

Which libraries exist for PDB (symbol file) generation?

I know that there are many libraries that parse PDB files and allow extracting debug information from them. For a project I am working on, I need to generate PDB files. Are there any publicly ...
tmr232's user avatar
  • 1,567
4 votes
0 answers
341 views

Modern equivalent to rsymtab for reconstructing symbol table for statically linked / stripped binaries?

I'm working with a 32-bit ELF binary that (I believe) has been statically linked against a few different third-party libraries. It has also been stripped, so I don't have much to go on with respect to ...
Colin's user avatar
  • 91
1 vote
1 answer
2k views

How to get the recovered memory references in IDA-Pro? [duplicate]

I want to collect all the IDA recovered symbol information in data sections (this information could be function name, or it could be an entry of jump table, or it could be a reference to other data ...
lllllllllllll's user avatar
2 votes
1 answer
711 views

How can I obtain the data of how many memory references are symbolized by IDA-Pro?

We all know that in typical programs, there exist some references. When compiling, linker will translate all the memory references into concrete memory addresses during the symbol relocation step. ...
lllllllllllll's user avatar
1 vote
1 answer
288 views

Reuse symbols in disassembling/reassembling a C++ program

it's me again. I am working on a tool can that disassemble/reassemble stripped binaries and now I am sucked in a (external) symbol reuse issue. The test is on 32-bit Linux x86 platform. Suppose I ...
lllllllllllll's user avatar
16 votes
2 answers
6k views

In a Mach-O executable, how can I find which function a stub targets?

Before exposing my problem, here's my understanding of the whole thing, so that you may correct me if I'm saying something wrong. In a Mach-O file (at least on x86), the __TEXT.__stubs section ...
zneak's user avatar
  • 321
9 votes
2 answers
15k views

Why does `ldd` and `(gdb) info sharedlibrary` show a different library base address?

I see three different outputs for where libc should be loaded. ldd shows the loading address of libc at 0xf7e9e000 $ ldd ~/my_tool linux-gate.so.1 => (0xf7ffe000) libc.so.6 => /lib/...
samuirai's user avatar
  • 3,079
1 vote
1 answer
434 views

How do I find non-exported symbols of a binary?

You can use nm(liux/mac) to find exported and imported functions/symbols, is it possible to find the non-exported symbols of a binary in a similar way? Are there command line tools to assist with this?...
Cala's user avatar
  • 11
1 vote
1 answer
2k views

How does IDA pro generate function names?

I am using IDA pro to decompile a series of applications. These applications share a common feature and what I have found is that in each decompilation each application shares the same set of ...
allbabel's user avatar
  • 179
3 votes
1 answer
3k views

WinDbg Debugging without symbols

So I am trying to learn how to debug files that I don't have the symbol files for. The most common advice is to issue bp $exentry or bu @$exentry. However, neither of these work. Once I g the ...
Robert Mason's user avatar