8 votes

Why does `ldd` and `(gdb) info sharedlibrary` show a different library base address?

ldd The program ldd is wrong for a few reasons. First, ldd is not meant to be accurate for determining load addresses. Use the environment variable LD_TRACE_LOADED_OBJECTS. Second, ldd will never ...
  • 2,287
4 votes

Decompiling 64bit ARMv8 Android .so library

The first tool is IDA decompiler (a plugin for IDA). As far as I know for now IDA has decompilers for x86, x64, ARM32, ARM64, PPC, PPC64, and MIPS (see here for more details, each of them costs ...
  • 7,955
3 votes
Accepted

ida identifies library function as regular function

There can be multiple reasons. the FLIRT signatures which have been loaded automatically do not have a pattern for this specific function. You can check which signatures have been applied and try ...
  • 35.1k
3 votes
Accepted

Is there a good place to search information about known DLLs?

I'm sorry to have to correct you, but VCRUNTIME140.dll is for example no known DLL (checked on Windows 7). "Known DLLs" is in fact a term that refers to a well-defined subset and the NT object manager ...
  • 10.5k
3 votes
Accepted

Determining an application's library call behaviour

This appears to be fairly typical virtual function call where the pointer to the virtual function table is stored in the object at offset 0000 and the call is to the function pointed to at offset 0028 ...
  • 2,249
3 votes
Accepted

How to figure out which library a native JNI function is calling?

I haven't touched Android in almost a year but IIRC: All JNI libraries need to be loaded from Java side first e.g. System.loadLibrary("hello-jni"); which translates to invoke-virtual in compiled ...
3 votes

Why does `ldd` and `(gdb) info sharedlibrary` show a different library base address?

First, ASLR will load the library at a (slightly) different address with each invocation, to help protect against malware. This is why the addresses between ldd and gdb are different, and why they may ...
2 votes

How to find the version number of Android Ad libraries from reverse engineered apps?

There is no perfect answer for this, it will greatly depend on your tolerance to false positives. Though there are three answers that come to mind depending on you level of effort you're willing to ...
  • 348
2 votes

Function dependencies in static libraries

You are actually asking multiple different questions here : [Regarding static linking only a few functions of a library] Are there any general reasons why this is not a good idea or impossible?...
  • 565
2 votes

How to figure out which library a native JNI function is calling?

It's been a while, but there should be a static code block with the .so they are calling. I would need to disassemble a file using a shared library. It will resemble: https://stackoverflow.com/...
  • 178
2 votes
Accepted

Antidebug/reverse engineering targeted for libraries

To the best of my knowledge theoretically most obfuscation techniques are also applicable to libraries, but there are considerable downsides: Slowdown and increased support-difficulties. Please note ...
  • 2,836
2 votes

How to detect only external-module calls?

I'd recommend using API Monitor for this. You can limit its trace to only display calls to GDI functions and DirectDraw functions:
2 votes

How to find the executable code of the native method in the library * .so? (Android)

There are two different ways to define JNI methods. The easiest way is to just give the functions special names like in the examples you've seen. However, this is not necessary. JNI methods can also ...
  • 1,972
2 votes

Reversing a .LIB file

I guess the files you found are index files. They contain the list of all pictures, ebooks, playlists (m3u) and so on, so the player doesn't have to open each individual file when you search for a ...
2 votes
Accepted

How can I see when a library is being called in Android?

It is a bit unclear what do you mean by "library being called". If you want to know when the library is loaded, you may look for references to System.loadLibrary(string) or System.load(...
  • 686
2 votes
Accepted

How to call a func in an executable binary?

LIEF If the binary is a PIE, exporting functions via the LIEF binary instrumentation framework should allow you to call the function you are interested in as if it was a function in a shared object. ...
  • 6,889
1 vote

Ida Pro doesn't recognize known function

I think you are looking for something called FLIRT signature. You can use them to identify common definitions from various libraries. You just need to download the flirt signatures, and let IDA do the ...
  • 169
1 vote
Accepted

How to view the functions of a loaded library in x64dbg

You can either press Ctrl+G and type LoadLibraryA to land at this function address, or if you want to list all the functions from kernel32.dll you can go to the Symbols tab like this: From there you ...
  • 686
1 vote
Accepted

macOS under M1, cannot find library

On ARM macOS, like on iOS, most of the common dylibs are no longer shipped as separate files, but are bundled into the dyld shared cache. You can usually find the caches in /System/Library/dyld/.
  • 35.1k
1 vote

Fixing Indirect Jump as Call?

goto the address, press d to decompile. if it looks like sensible code, then press F to make it a function. This is common for function pointers, windows COM, callbacks etc. If your on an embedded ...
  • 11
1 vote

Ghidra : iOS Application : Mach-O binary -> Symbol files of dylib or framework are not generated

It's very likely that Ghidra doesn't know how to read the symbols from the dyld_shared_cache. You can try to use a different tool like IDA PRO, Rizin or radare2 or Cutter, etc. But, which binary are ...
1 vote

Cannot disassemble exported functions

This is not true for all functions in kernel32.dll, but for specific functions that are imported from other dlls. You have to find out where the function is imported from and then look at the ...
  • 113
1 vote

OTOOL alternative for linux

I am in a similar position carrying out iOS related work on an Ubuntu host. The suggestions to use objdump will not work unless it has been compiled specifically with support of Mach-O binaries which ...
  • 107
1 vote

OTOOL alternative for linux

If you have stripped binaries there's little you can do regardless of the platform you're on. To view disassembled code on Linux, as you would with Otool on Mac, you can use objDump: objdump --...
1 vote

Is there a good place to search information about known DLLs?

if they are Microsoft dlls you are interested to know about then ms normally provides a concise description of its dlls functionality in it FileVersion information also other legitimate dlls ...
  • 15.2k
1 vote

How to detect internal and shared libraries used in an executable file?

I can see two paths for moving forward. First, following your current approach, you can probably detect version information and library automatically in the strings you find. This is not a ...
  • 11.4k
1 vote

Antidebug/reverse engineering targeted for libraries

I think all anti-debug and anti-reversing techniques are also applicable to shared and static libraries. Shared libraries are still code, just placed in a different file format. I guess people don't ...
1 vote
Accepted

ldd doesn't show dynamic libraries

They can load their dynamic libraries dynamically by using dlopen and dlsym functions. Here is the man page of dlsym and usage example
  • 7,955

Only top scored, non community-wiki answers of a minimum length are eligible