7
votes
Accepted
How .reloc Section is used in PE file?
"Each block must start on a 32-bit boundary" - I don't understand that, can you explain it?
It means even if you have space after your block finished, you must use next 32-bit aligned ...
6
votes
Dynamically v. Statically linked
There is no sharp difference between dynamically linked and statically linked, since it's always possible to link some libraries dynamically, and others statically, in the same binary.
For example, ...
- 12.7k
5
votes
Accepted
Rebuild symbol table
You can call a function at any address. So, load the dynamic library into your process address space, figure out the base of the newly loaded library and take the offset from the base of the library ...
- 5,561
4
votes
How the dynamic linker determines which routine to call on Linux?
The initial function being jumped to is the PLT0 stub which calls the glibc's _dl_runtime_resolve via pointer in GOT[2] (pre-filled by the dynamic loader):
.plt:00008530 STR LR, [SP,...
- 34.9k
4
votes
Accepted
Resolve Addresses To Function Names
i dont know if i understood your query correctly but if you want to log the function names that are passed to getproc address you can log them like this in windbg
C:\>cdb calc
Microsoft (R) ...
- 15k
4
votes
Accepted
Radare2 debugging - How to get into lazy imported functions?
The sym.imp.* symbols are pointing to the plt and this is intended. In order to locate a specific function of a loaded module/library, you need to use the dmi command and its subcommands.
To follow ...
- 8,659
3
votes
Accepted
There is something else than a "DllMain" in a module for its initialization?
In case of programs you'd also have to watch out for TLS callbacks. These run prior to the entry point, but I have only ever seen those on .exe files, never on DLLs. Still, Peter Ferrie stated that ...
- 10.5k
3
votes
Accepted
ELF file format find shared object for symbol
how does the Unix loader know what is the module,
shared object where to search for this symbol
Short answer: it does not. It just searches the whole list of loaded modules until the symbol is ...
- 34.9k
3
votes
Could not find ld-linux-x86-64.so.2 in strace output
A very similar question to this can be found on stackoverflow: How does execve call dynamic linker/loader (ld-linux.so.2)
The reason there is no strace output associated with the dynamic linker is ...
- 6,859
3
votes
How to locate dynamic instructions?
Being an avid Cheat Engine user and game-hacker, I can walk you through a specific example that should give you solid clarity.
First, we'll use this arbitrary bit of code to work with:
7A1A7A162 - ...
- 2,154
3
votes
Accepted
How to re-use some asm code when GOT/GOT.PLT references involved?
If you're using GAS or a compatible assembler, you can use special modifiers to have it emit relocation info for GOT-based addressing.
Here's the gcc -S output of a typical prolog of a function ...
- 34.9k
3
votes
Dylib can run without code sign in iOS?
EDIT: The below applies only to non-jailbroken devices. Jailbreaks usually disable signature checking completely to allow unsigned homebrew software to run.
Apparently only libraries which are listed ...
- 34.9k
2
votes
How the dynamic linker determines which routine to call on Linux?
This is done using the standard relocation methods which have been in ELF since long before the invention of the plt (procedure linking table).
Long ago (for some definition of long), external ...
- 12.7k
2
votes
What is an "addend"?
I think it just means "a number that's added", and in this case "the number that's added to the base load address (or segment load address) to compute the final pointer for this relocation".
Let's ...
- 160
2
votes
Accepted
What is an "addend"?
Augend is a term that means a number that is subject to addition
Addend is the number that you will be adding.
From Dictionary.com,
Have you ever found yourself staring at a piece of paper with “3 ...
- 1,664
2
votes
Accepted
Find out version of statically linked MFC from an exe
All statically linked MFC binaries I've seen always include strings for some internal classes. The naming convention can be found in afximpl.h:
#define AFX_WNDCLASS(s) \
_T("Afx") _T(s) ...
- 34.9k
2
votes
Dynamically linked shared objects
There are two things at work here that might be making it look a bit tricky:
virtual memory - see e.g. articles at Wikipedia for a refresher of the concepts of virtual memory or page table.
address ...
- 121
1
vote
How is it possible to generate C++ class header from a .dll or ELF file?
If you expect something like full class definitions with field and method names, it’s simply not possible: all such information is not necessary for program execution and is discarded by the compiler. ...
- 34.9k
1
vote
What is most likely the reason causing this problem?
PHT means “program header table” and is one of the two tables describing the layout of the ELF file. The PHT is the one used by the OS to decide which parts of the file are mapped at what addresses in ...
- 34.9k
1
vote
How do I execute "File -> Add To Program..." in a Ghidra script?
Are they raw files loaded by special mechanisms or typical .so or .dll shared objects? Given the dll tag I am assuming you are concerned about .dll files.
On importing a program for the first time you ...
- 1,251
1
vote
Questions regarding PLT/GOT and statically linking
You are given only the code of the main() and winner() functions because only these ones are relevant for the exploitation. But, of course, the binary embed also the code of malloc() and free() which ...
- 18.1k
1
vote
Accepted
DT_DEBUG not filled on dlopen
You should probably check the dynamic linker source code to be sure but I suspect that DT_DEBUG is only filled for the main binary and not the additional modules.
- 34.9k
1
vote
Macho - remove a LOAD COMMAND from iOS binary
If you compile optool from source, there is a new unrestrict flag.
optool unrestrict -t Payload/MY_APP.app/MY_APP
This worked. Load command removed.
There is even a nice guide explaining how to ...
- 163
1
vote
What is an "addend"?
Addend is simply "a number to be added to another", according to Merian Webster.
- 115
1
vote
How can I resolve dynamic addresses (for APIs,DLLs etc.) to disassemble in IDA Pro?
you could write a script which will get all xref's toGetProcAddressthen go one by one to checkGetProcAddress second parametes lpProcName next follow disassembly trace return value eax to first memory ...
- 357
1
vote
Is it possible to call function in dynamic link library(.so) generated by Android JNI project?
Have a look at NativeFunction API of frida. It helps you call any native function. With a little bit of reversing, you'll have something like
var func = new NativeFunction(Module.findExportByName('...
- 2,389
1
vote
Can I statically link (not import) the Windows system DLLs?
Other people have mentioned the downsides of this, but if you're still interested in this path, then here's a lib that converts the ntdll API names into syscalls.
- 51
1
vote
Accepted
How to recognize the function call in a dynamic lib?
Doing it the hard way:
disassemble the target PLT stub and figure out what pointer it's using. E.g.:
359dc: e28fc601 add ip, pc, #1048576 ; 0x100000
359e0: e28ccaa2 add ip, ip, #663552 ; ...
- 34.9k
1
vote
Accepted
ldd doesn't show dynamic libraries
They can load their dynamic libraries dynamically by using dlopen and dlsym functions.
Here is the man page of dlsym and usage example
- 7,875
1
vote
Accepted
How to load library defined symbols to a specified location?
in the code (or in the linker command file) create a memory name (say .stdio) and give it a specific address. then write a section statement: '.stdio' and list the 'stdio.text' will then be the ...
- 136
Only top scored, non community-wiki answers of a minimum length are eligible