4
votes
Decompiling 64bit ARMv8 Android .so library
The first tool is IDA decompiler (a plugin for IDA).
As far as I know for now IDA has decompilers for x86, x64, ARM32, ARM64, PPC, PPC64, and MIPS (see here for more details, each of them costs ...
- 8,185
3
votes
Accepted
Determining an application's library call behaviour
This appears to be fairly typical virtual function call where the pointer to the virtual function table is stored in the object at offset 0000 and the call is to the function pointed to at offset 0028 ...
- 2,384
3
votes
Accepted
How to call a func in an executable binary?
LIEF
If the binary is a PIE, exporting functions via the LIEF binary instrumentation framework should allow you to call the function you are interested in as if it was a function in a shared object.
...
- 6,958
3
votes
Accepted
ida identifies library function as regular function
There can be multiple reasons.
the FLIRT signatures which have been loaded automatically do not have a pattern for this specific function. You can check which signatures have been applied and try ...
- 35.6k
3
votes
OTOOL alternative for linux
I am in a similar position carrying out iOS related work on an Ubuntu host.
The suggestions to use objdump will not work unless it has been compiled specifically with support of Mach-O binaries which ...
- 157
3
votes
Accepted
Is there a good place to search information about known DLLs?
I'm sorry to have to correct you, but VCRUNTIME140.dll is for example no known DLL (checked on Windows 7). "Known DLLs" is in fact a term that refers to a well-defined subset and the NT object manager ...
- 10.6k
3
votes
Accepted
How to figure out which library a native JNI function is calling?
I haven't touched Android in almost a year but IIRC:
All JNI libraries need to be loaded from Java side first e.g.
System.loadLibrary("hello-jni");
which translates to invoke-virtual in compiled ...
- 843
2
votes
How to figure out which library a native JNI function is calling?
It's been a while, but there should be a static code block with the .so they are calling. I would need to disassemble a file using a shared library.
It will resemble:
https://stackoverflow.com/...
- 178
2
votes
Accepted
Antidebug/reverse engineering targeted for libraries
To the best of my knowledge theoretically most obfuscation techniques are also applicable to libraries, but there are considerable downsides: Slowdown and increased support-difficulties. Please note ...
- 2,886
2
votes
Function dependencies in static libraries
You are actually asking multiple different questions here :
[Regarding static linking only a few functions of a library]
Are there any general reasons why this is not a good idea or impossible?...
- 565
2
votes
How to find the executable code of the native method in the library * .so? (Android)
There are two different ways to define JNI methods. The easiest way is to just give the functions special names like in the examples you've seen.
However, this is not necessary. JNI methods can also ...
- 1,972
2
votes
Reversing a .LIB file
I guess the files you found are index files. They contain the list of all pictures, ebooks, playlists (m3u) and so on, so the player doesn't have to open each individual file when you search for a ...
- 921
2
votes
Accepted
macOS under M1, cannot find library
On ARM macOS, like on iOS, most of the common dylibs are no longer shipped as separate files, but are bundled into the dyld shared cache. You can usually find the caches in /System/Library/dyld/.
- 35.6k
2
votes
Accepted
How can I see when a library is being called in Android?
It is a bit unclear what do you mean by "library being called". If you want to know when the library is loaded, you may look for references to System.loadLibrary(string) or System.load(...
- 686
2
votes
Check if libc.so use tcache
You can check if the libc.so uses tcache and determine the value of arena_max by using a reverse engineering tool such as gdb. The following steps can be used to check for tcache:
Launch gdb: gdb -q ...
- 126
1
vote
Zlib structure inside a GCC static library
Hard to tell without a look at the library in question, but my guess would be that the contained object files contain zlib-compressed debug information.
Have a look here and look for "zlib" ...
- 10.6k
1
vote
Ida Pro doesn't recognize known function
I think you are looking for something called FLIRT signature. You can use them to identify common definitions from various libraries. You just need to download the flirt signatures, and let IDA do the ...
- 189
1
vote
Accepted
How to view the functions of a loaded library in x64dbg
You can either press Ctrl+G and type LoadLibraryA to land at this function address, or if you want to list all the functions from kernel32.dll you can go to the Symbols tab like this:
From there you ...
- 686
1
vote
Fixing Indirect Jump as Call?
goto the address, press d to decompile. if it looks like sensible code, then press F to make it a function. This is common for function pointers, windows COM, callbacks etc.
If your on an embedded ...
- 11
1
vote
Ghidra : iOS Application : Mach-O binary -> Symbol files of dylib or framework are not generated
It's very likely that Ghidra doesn't know how to read the symbols from the dyld_shared_cache. You can try to use a different tool like IDA PRO, Rizin or radare2 or Cutter, etc.
But, which binary are ...
- 100
1
vote
Cannot disassemble exported functions
This is not true for all functions in kernel32.dll, but for specific functions that are imported from other dlls. You have to find out where the function is imported from and then look at the ...
- 133
1
vote
OTOOL alternative for linux
If you have stripped binaries there's little you can do regardless of the platform you're on.
To view disassembled code on Linux, as you would with Otool on Mac, you can use objDump:
objdump --...
- 11
1
vote
Is there a good place to search information about known DLLs?
if they are Microsoft dlls you are interested to know about
then ms normally provides a concise description of its dlls functionality in it FileVersion information
also other legitimate dlls ...
- 15.7k
1
vote
How to detect internal and shared libraries used in an executable file?
I can see two paths for moving forward.
First, following your current approach, you can probably detect version information and library automatically in the strings you find. This is not a ...
- 11.6k
1
vote
Accepted
ldd doesn't show dynamic libraries
They can load their dynamic libraries dynamically by using dlopen and dlsym functions.
Here is the man page of dlsym and usage example
- 8,185
1
vote
Antidebug/reverse engineering targeted for libraries
I think all anti-debug and anti-reversing techniques are also applicable to shared and static libraries. Shared libraries are still code, just placed in a different file format. I guess people don't ...
- 176
Only top scored, non community-wiki answers of a minimum length are eligible