4 votes

OTOOL alternative for linux

I am in a similar position carrying out iOS related work on an Ubuntu host. The suggestions to use objdump will not work unless it has been compiled specifically with support of Mach-O binaries which ...
Jon's user avatar
  • 167
4 votes

Decompiling 64bit ARMv8 Android .so library

The first tool is IDA decompiler (a plugin for IDA). As far as I know for now IDA has decompilers for x86, x64, ARM32, ARM64, PPC, PPC64, and MIPS (see here for more details, each of them costs ...
w s's user avatar
  • 8,448
4 votes
Accepted

How to call a func in an executable binary?

LIEF If the binary is a PIE, exporting functions via the LIEF binary instrumentation framework should allow you to call the function you are interested in as if it was a function in a shared object. ...
julian's user avatar
  • 7,118
3 votes
Accepted

ida identifies library function as regular function

There can be multiple reasons. the FLIRT signatures which have been loaded automatically do not have a pattern for this specific function. You can check which signatures have been applied and try ...
Igor Skochinsky's user avatar
  • 36.5k
3 votes
Accepted

Is there a good place to search information about known DLLs?

I'm sorry to have to correct you, but VCRUNTIME140.dll is for example no known DLL (checked on Windows 7). "Known DLLs" is in fact a term that refers to a well-defined subset and the NT object manager ...
0xC0000022L's user avatar
  • 10.9k
3 votes
Accepted

Determining an application's library call behaviour

This appears to be fairly typical virtual function call where the pointer to the virtual function table is stored in the object at offset 0000 and the call is to the function pointed to at offset 0028 ...
Ian Cook's user avatar
  • 2,523
3 votes
Accepted

How to figure out which library a native JNI function is calling?

I haven't touched Android in almost a year but IIRC: All JNI libraries need to be loaded from Java side first e.g. System.loadLibrary("hello-jni"); which translates to invoke-virtual in compiled ...
Vitaly Osipov's user avatar
2 votes

How to figure out which library a native JNI function is calling?

It's been a while, but there should be a static code block with the .so they are calling. I would need to disassemble a file using a shared library. It will resemble: https://stackoverflow.com/...
Thomas's user avatar
  • 178
2 votes
Accepted

Antidebug/reverse engineering targeted for libraries

To the best of my knowledge theoretically most obfuscation techniques are also applicable to libraries, but there are considerable downsides: Slowdown and increased support-difficulties. Please note ...
Nordwald's user avatar
  • 2,896
2 votes

Function dependencies in static libraries

You are actually asking multiple different questions here : [Regarding static linking only a few functions of a library] Are there any general reasons why this is not a good idea or impossible?...
user2823000's user avatar
2 votes

How to find the executable code of the native method in the library * .so? (Android)

There are two different ways to define JNI methods. The easiest way is to just give the functions special names like in the examples you've seen. However, this is not necessary. JNI methods can also ...
Antimony's user avatar
  • 2,012
2 votes
Accepted

How can I see when a library is being called in Android?

It is a bit unclear what do you mean by "library being called". If you want to know when the library is loaded, you may look for references to System.loadLibrary(string) or System.load(...
morsisko's user avatar
  • 696
2 votes

Reversing a .LIB file

I guess the files you found are index files. They contain the list of all pictures, ebooks, playlists (m3u) and so on, so the player doesn't have to open each individual file when you search for a ...
Michael Karcher's user avatar
2 votes
Accepted

macOS under M1, cannot find library

On ARM macOS, like on iOS, most of the common dylibs are no longer shipped as separate files, but are bundled into the dyld shared cache. You can usually find the caches in /System/Library/dyld/.
Igor Skochinsky's user avatar
  • 36.5k
2 votes

Check if libc.so use tcache

You can check if the libc.so uses tcache and determine the value of arena_max by using a reverse engineering tool such as gdb. The following steps can be used to check for tcache: Launch gdb: gdb -q ...
raheel0x01's user avatar
1 vote

Zlib structure inside a GCC static library

Hard to tell without a look at the library in question, but my guess would be that the contained object files contain zlib-compressed debug information. Have a look here and look for "zlib" ...
0xC0000022L's user avatar
  • 10.9k
1 vote

Ida Pro doesn't recognize known function

I think you are looking for something called FLIRT signature. You can use them to identify common definitions from various libraries. You just need to download the flirt signatures, and let IDA do the ...
Niraeth's user avatar
  • 189
1 vote

Fixing Indirect Jump as Call?

goto the address, press d to decompile. if it looks like sensible code, then press F to make it a function. This is common for function pointers, windows COM, callbacks etc. If your on an embedded ...
Euan's user avatar
  • 11
1 vote

Ghidra : iOS Application : Mach-O binary -> Symbol files of dylib or framework are not generated

It's very likely that Ghidra doesn't know how to read the symbols from the dyld_shared_cache. You can try to use a different tool like IDA PRO, Rizin or radare2 or Cutter, etc. But, which binary are ...
BadSugar's user avatar
  • 110
1 vote

Cannot disassemble exported functions

This is not true for all functions in kernel32.dll, but for specific functions that are imported from other dlls. You have to find out where the function is imported from and then look at the ...
tly's user avatar
  • 133
1 vote
Accepted

How to view the functions of a loaded library in x64dbg

You can either press Ctrl+G and type LoadLibraryA to land at this function address, or if you want to list all the functions from kernel32.dll you can go to the Symbols tab like this: From there you ...
morsisko's user avatar
  • 696
1 vote

OTOOL alternative for linux

If you have stripped binaries there's little you can do regardless of the platform you're on. To view disassembled code on Linux, as you would with Otool on Mac, you can use objDump: objdump --...
Andy Pieters's user avatar
1 vote

Is there a good place to search information about known DLLs?

if they are Microsoft dlls you are interested to know about then ms normally provides a concise description of its dlls functionality in it FileVersion information also other legitimate dlls ...
blabb's user avatar
  • 16.3k
1 vote

How to detect internal and shared libraries used in an executable file?

I can see two paths for moving forward. First, following your current approach, you can probably detect version information and library automatically in the strings you find. This is not a ...
NirIzr's user avatar
  • 11.8k
1 vote

Antidebug/reverse engineering targeted for libraries

I think all anti-debug and anti-reversing techniques are also applicable to shared and static libraries. Shared libraries are still code, just placed in a different file format. I guess people don't ...
yellowbyte's user avatar

Only top scored, non community-wiki answers of a minimum length are eligible