23
To answer to this question, we have first to rephrase it a bit. The real question can be stated like this:
What are the symbols that cannot be removed from an ELF binary file ?
Indeed, strip removes quite a bit of information from the ELF file, but it could do a bit more (see the option --strip-unneeded from strip or the program sstrip for more about ...
16
Let me start by telling you that what you want would be impossible, because of how well-known DLLs work. You can attempt something similar with tools like PEBundle or dllpackager, but that will usually (I'd say certainly) fail with the well-known DLLs (such as system DLLs as well as even the MSVC runtime DLLs in their different incarnations). See this and ...
15
The Windows kernel, unlike Linux or OS X, does not use consistent syscall numbering across versions. The numbers can change even after a servicepack release. For example, the NtReadFile syscall was 0x0086 on Windows NT 4 but on Windows 7 it's 0x0111 (see here for the full list).
That's why all proper programs use the kernel32.dll (or ntdll.dll) to perform ...
10
In fact, ldd is loading the libraries on-the-fly to list what libraries are needed. So, on this run, you can say that libc.so.6 has been loaded at 0xb7e5c000, but you have no warranty that it will always be the case. Even with no ASLR, it is mainly depending on the loading order of the libraries that might vary from one run to another.
Nevertheless, ...
8
use nm instead of strings. Undefined symbols (indicated by a U) will be resolved externally (by the libc or whatever), and T (or t) symbols are locally defined. Lowercase indicates a local symbol, uppercase a global symbol.
Of course, this assumes there's a symbol table present. In your example, it's been stripped.
In that case, you can do objdump -T file ...
7
"Each block must start on a 32-bit boundary" - I don't understand that, can you explain it?
It means even if you have space after your block finished, you must use next 32-bit aligned address for your RVA. In my opinion, it is mostly because of page optimization. You can read this document for further understanding.
Do PE files use ...
6
There is no sharp difference between dynamically linked and statically linked, since it's always possible to link some libraries dynamically, and others statically, in the same binary.
For example, an application i hacked reversed parts of recently (android, in this case, but only a thin java wrapper to a large binary) had over 20 open source libraries ...
6
Yes, the base address of libc.so.6 should be 0xb7e5c000 for that binary. You can verify this by catting /proc/<pid>/maps while your application is running.
5
You can call a function at any address. So, load the dynamic library into your process address space, figure out the base of the newly loaded library and take the offset from the base of the library of the function you wan't to call and add that together.
So if IDA says the base of the binary is 0x4000 and your function is at address 0x4100, then you have ...
5
The answer to your question is fairly easy. You can either use the nm command with the -D switch (or --dynamic), or use objdump with the -T switch. Both commands will output the dynamic symbol table entries and the libraries they originate from.
4
The initial function being jumped to is the PLT0 stub which calls the glibc's _dl_runtime_resolve via pointer in GOT[2] (pre-filled by the dynamic loader):
.plt:00008530 STR LR, [SP,#-4]!
.plt:00008534 LDR LR, =(_GLOBAL_OFFSET_TABLE_ - 0x8540)
.plt:00008538 ADD LR, PC, LR ; _GLOBAL_OFFSET_TABLE_
.plt:...
4
The sym.imp.* symbols are pointing to the plt and this is intended. In order to locate a specific function of a loaded module/library, you need to use the dmi command and its subcommands.
To follow your example, in the following steps I'll demonstrate how to reach the address of __swprintf_chk.
First, open a binary in a debug mode. I'm using the same ...
4
i dont know if i understood your query correctly but if you want to log the function names that are passed to getproc address you can log them like this in windbg
C:\>cdb calc
Microsoft (R) Windows Debugger Version 10.0.15063.468 X86
ntdll!LdrpDoDebuggerBreak+0x2c:
775605a6 cc int 3
0:000> bp KERNELBASE!GetProcAddress ".printf \"%...
3
In case of programs you'd also have to watch out for TLS callbacks. These run prior to the entry point, but I have only ever seen those on .exe files, never on DLLs. Still, Peter Ferrie stated that TLS callbacks exist for DLL files. I'd trust his expertise on this, even though I've never seen one of those myself, when reverse engineering a DLL.
Anyway, ...
3
A very similar question to this can be found on stackoverflow: How does execve call dynamic linker/loader (ld-linux.so.2)
The reason there is no strace output associated with the dynamic linker is that control is passed to the dynamic linker during process creation by the kernel. In other words, the dynamic linker is not invoked from userspace via a system ...
3
Being an avid Cheat Engine user and game-hacker, I can walk you through a specific example that should give you solid clarity.
First, we'll use this arbitrary bit of code to work with:
7A1A7A162 - 55 - push rbp
7A1A7A163 - 00 6E 00 - add [rsi+00],ch
7A1A7A166 - 69 00 74000000 - imul eax,[rax],00000074 { 116 }
...
3
EDIT: The below applies only to non-jailbroken devices. Jailbreaks usually disable signature checking completely to allow unsigned homebrew software to run.
Apparently only libraries which are listed as dependencies of the executable in the header (LC_LOAD_DYLIB and similar commands) are checked, and those loaded with dlopen are not.
This is mentioned ...
3
If you're using GAS or a compatible assembler, you can use special modifiers to have it emit relocation info for GOT-based addressing.
Here's the gcc -S output of a typical prolog of a function compiled with -fPIC:
call __i686.get_pc_thunk.bx
addl $_GLOBAL_OFFSET_TABLE_, %ebx
leal .LC0@GOTOFF(%ebx), %eax
movl %eax, (%esp)
call puts@PLT
As ...
3
Normally, the first parameter to CallWindowProc would be a function pointer. CallWindowProc treats the pointer to the string as a function pointer, and calls it. As long as the heap that the string exists in is executable, it will be executed as if it were machine code. The other four parameters passed to CallWindowProc are also passed to the function ...
3
how does the Unix loader know what is the module,
shared object where to search for this symbol
Short answer: it does not. It just searches the whole list of loaded modules until the symbol is found (or not). A small degree of control over more exact symbol matching can be achieved via versioned symbols but otherwise it's pretty much a free-for-all.
By ...
2
Probably with full intent from MS, not only does syscall numbering change between versions, but also many DLL ordinal values do too. Need to bind to WIN32 and use the full function name if you want your code to work across os releases.
2
This is done using the standard relocation methods which have been in ELF since long before the invention of the plt (procedure linking table).
Long ago (for some definition of long), external functions were called directly from within code. Which means, if your program called printf from 1000 different places, each of these 1000 places had to be adjusted ...
2
Augend is a term that means a number that is subject to addition
Addend is the number that you will be adding.
From Dictionary.com,
Have you ever found yourself staring at a piece of paper with “3 + 4” written on it, and wondered ‘what is the proper term for each of these two respective quantities?’ No? The first number is the augend and the number that ...
2
I think it just means "a number that's added", and in this case "the number that's added to the base load address (or segment load address) to compute the final pointer for this relocation".
Let's imagine that when we load our binary into memory at 0x400000 we have a pointer at 0x401234 that points to 0x405678. (If instead we loaded the binary at 0x800000 ...
1
You should probably check the dynamic linker source code to be sure but I suspect that DT_DEBUG is only filled for the main binary and not the additional modules.
1
If you compile optool from source, there is a new unrestrict flag.
optool unrestrict -t Payload/MY_APP.app/MY_APP
This worked. Load command removed.
There is even a nice guide explaining how to compile from source, here.
1
Addend is simply "a number to be added to another", according to Merian Webster.
1
you could write a script which will get all xref's toGetProcAddressthen go one by one to checkGetProcAddress second parametes lpProcName next follow disassembly trace return value eax to first memory write e.g. mov dword ptr [unknown_ptr], eax and rename the pointer.
For inspiration look at IDAscope plugin:
https://hex-rays.com/contests/2012/index.shtml#...
1
Have a look at NativeFunction API of frida. It helps you call any native function. With a little bit of reversing, you'll have something like
var func = new NativeFunction(Module.findExportByName('libxx.so', 'fun'), 'uint32', []);
1
Doing it the hard way:
disassemble the target PLT stub and figure out what pointer it's using. E.g.:
359dc: e28fc601 add ip, pc, #1048576 ; 0x100000
359e0: e28ccaa2 add ip, ip, #663552 ; 0xa2000
359e4: e5bcf900 ldr pc, [ip, #2304]! ; 0x900
Here, the ip will be: 0x359e4+0x100000+0xa2000 = 0x1D79E4, so the last LDR will dereference 1D79E4+...
Only top voted, non community-wiki answers of a minimum length are eligible
