7 votes
Accepted

How .reloc Section is used in PE file?

"Each block must start on a 32-bit boundary" - I don't understand that, can you explain it? It means even if you have space after your block finished, you must use next 32-bit aligned ...
user avatar
6 votes

Dynamically v. Statically linked

There is no sharp difference between dynamically linked and statically linked, since it's always possible to link some libraries dynamically, and others statically, in the same binary. For example, ...
user avatar
5 votes
Accepted

Rebuild symbol table

You can call a function at any address. So, load the dynamic library into your process address space, figure out the base of the newly loaded library and take the offset from the base of the library ...
user avatar
4 votes

How the dynamic linker determines which routine to call on Linux?

The initial function being jumped to is the PLT0 stub which calls the glibc's _dl_runtime_resolve via pointer in GOT[2] (pre-filled by the dynamic loader): .plt:00008530 STR LR, [SP,...
user avatar
  • 34.9k
4 votes
Accepted

Resolve Addresses To Function Names

i dont know if i understood your query correctly but if you want to log the function names that are passed to getproc address you can log them like this in windbg C:\>cdb calc Microsoft (R) ...
user avatar
  • 15k
4 votes
Accepted

Radare2 debugging - How to get into lazy imported functions?

The sym.imp.* symbols are pointing to the plt and this is intended. In order to locate a specific function of a loaded module/library, you need to use the dmi command and its subcommands. To follow ...
user avatar
  • 8,659
3 votes
Accepted

There is something else than a "DllMain" in a module for its initialization?

In case of programs you'd also have to watch out for TLS callbacks. These run prior to the entry point, but I have only ever seen those on .exe files, never on DLLs. Still, Peter Ferrie stated that ...
user avatar
  • 10.5k
3 votes
Accepted

ELF file format find shared object for symbol

how does the Unix loader know what is the module, shared object where to search for this symbol Short answer: it does not. It just searches the whole list of loaded modules until the symbol is ...
user avatar
  • 34.9k
3 votes

Could not find ld-linux-x86-64.so.2 in strace output

A very similar question to this can be found on stackoverflow: How does execve call dynamic linker/loader (ld-linux.so.2) The reason there is no strace output associated with the dynamic linker is ...
user avatar
  • 6,859
3 votes

How to locate dynamic instructions?

Being an avid Cheat Engine user and game-hacker, I can walk you through a specific example that should give you solid clarity. First, we'll use this arbitrary bit of code to work with: 7A1A7A162 - ...
user avatar
  • 2,154
3 votes
Accepted

How to re-use some asm code when GOT/GOT.PLT references involved?

If you're using GAS or a compatible assembler, you can use special modifiers to have it emit relocation info for GOT-based addressing. Here's the gcc -S output of a typical prolog of a function ...
user avatar
  • 34.9k
3 votes

Dylib can run without code sign in iOS?

EDIT: The below applies only to non-jailbroken devices. Jailbreaks usually disable signature checking completely to allow unsigned homebrew software to run. Apparently only libraries which are listed ...
user avatar
  • 34.9k
2 votes

How the dynamic linker determines which routine to call on Linux?

This is done using the standard relocation methods which have been in ELF since long before the invention of the plt (procedure linking table). Long ago (for some definition of long), external ...
user avatar
2 votes

What is an "addend"?

I think it just means "a number that's added", and in this case "the number that's added to the base load address (or segment load address) to compute the final pointer for this relocation". Let's ...
user avatar
  • 160
2 votes
Accepted

What is an "addend"?

Augend is a term that means a number that is subject to addition Addend is the number that you will be adding. From Dictionary.com, Have you ever found yourself staring at a piece of paper with “3 ...
user avatar
  • 1,664
2 votes
Accepted

Find out version of statically linked MFC from an exe

All statically linked MFC binaries I've seen always include strings for some internal classes. The naming convention can be found in afximpl.h: #define AFX_WNDCLASS(s) \ _T("Afx") _T(s) ...
user avatar
  • 34.9k
2 votes

Dynamically linked shared objects

There are two things at work here that might be making it look a bit tricky: virtual memory - see e.g. articles at Wikipedia for a refresher of the concepts of virtual memory or page table. address ...
user avatar
  • 121
1 vote

How is it possible to generate C++ class header from a .dll or ELF file?

If you expect something like full class definitions with field and method names, it’s simply not possible: all such information is not necessary for program execution and is discarded by the compiler. ...
user avatar
  • 34.9k
1 vote

What is most likely the reason causing this problem?

PHT means “program header table” and is one of the two tables describing the layout of the ELF file. The PHT is the one used by the OS to decide which parts of the file are mapped at what addresses in ...
user avatar
  • 34.9k
1 vote

How do I execute "File -> Add To Program..." in a Ghidra script?

Are they raw files loaded by special mechanisms or typical .so or .dll shared objects? Given the dll tag I am assuming you are concerned about .dll files. On importing a program for the first time you ...
user avatar
1 vote

Questions regarding PLT/GOT and statically linking

You are given only the code of the main() and winner() functions because only these ones are relevant for the exploitation. But, of course, the binary embed also the code of malloc() and free() which ...
user avatar
  • 18.1k
1 vote
Accepted

DT_DEBUG not filled on dlopen

You should probably check the dynamic linker source code to be sure but I suspect that DT_DEBUG is only filled for the main binary and not the additional modules.
user avatar
  • 34.9k
1 vote

Macho - remove a LOAD COMMAND from iOS binary

If you compile optool from source, there is a new unrestrict flag. optool unrestrict -t Payload/MY_APP.app/MY_APP This worked. Load command removed. There is even a nice guide explaining how to ...
user avatar
1 vote

What is an "addend"?

Addend is simply "a number to be added to another", according to Merian Webster.
user avatar
  • 115
1 vote

How can I resolve dynamic addresses (for APIs,DLLs etc.) to disassemble in IDA Pro?

you could write a script which will get all xref's toGetProcAddressthen go one by one to checkGetProcAddress second parametes lpProcName next follow disassembly trace return value eax to first memory ...
user avatar
  • 357
1 vote

Is it possible to call function in dynamic link library(.so) generated by Android JNI project?

Have a look at NativeFunction API of frida. It helps you call any native function. With a little bit of reversing, you'll have something like var func = new NativeFunction(Module.findExportByName('...
user avatar
  • 2,389
1 vote

Can I statically link (not import) the Windows system DLLs?

Other people have mentioned the downsides of this, but if you're still interested in this path, then here's a lib that converts the ntdll API names into syscalls.
user avatar
1 vote
Accepted

How to recognize the function call in a dynamic lib?

Doing it the hard way: disassemble the target PLT stub and figure out what pointer it's using. E.g.: 359dc: e28fc601 add ip, pc, #1048576 ; 0x100000 359e0: e28ccaa2 add ip, ip, #663552 ; ...
user avatar
  • 34.9k
1 vote
Accepted

ldd doesn't show dynamic libraries

They can load their dynamic libraries dynamically by using dlopen and dlsym functions. Here is the man page of dlsym and usage example
user avatar
  • 7,875
1 vote
Accepted

How to load library defined symbols to a specified location?

in the code (or in the linker command file) create a memory name (say .stdio) and give it a specific address. then write a section statement: '.stdio' and list the 'stdio.text' will then be the ...
user avatar

Only top scored, non community-wiki answers of a minimum length are eligible