8 votes

Why does `ldd` and `(gdb) info sharedlibrary` show a different library base address?

ldd The program ldd is wrong for a few reasons. First, ldd is not meant to be accurate for determining load addresses. Use the environment variable LD_TRACE_LOADED_OBJECTS. Second, ldd will never ...
user avatar
  • 2,279
4 votes

Decompiling 64bit ARMv8 Android .so library

The first tool is IDA decompiler (a plugin for IDA). As far as I know for now IDA has decompilers for x86, x64, ARM32, ARM64, PPC, PPC64, and MIPS (see here for more details, each of them costs ...
user avatar
  • 7,700
3 votes
Accepted

ida identifies library function as regular function

There can be multiple reasons. the FLIRT signatures which have been loaded automatically do not have a pattern for this specific function. You can check which signatures have been applied and try ...
user avatar
  • 34.6k
3 votes
Accepted

Is there a good place to search information about known DLLs?

I'm sorry to have to correct you, but VCRUNTIME140.dll is for example no known DLL (checked on Windows 7). "Known DLLs" is in fact a term that refers to a well-defined subset and the NT object manager ...
user avatar
  • 10.5k
3 votes
Accepted

Determining an application's library call behaviour

This appears to be fairly typical virtual function call where the pointer to the virtual function table is stored in the object at offset 0000 and the call is to the function pointed to at offset 0028 ...
user avatar
  • 2,134
3 votes
Accepted

How to figure out which library a native JNI function is calling?

I haven't touched Android in almost a year but IIRC: All JNI libraries need to be loaded from Java side first e.g. System.loadLibrary("hello-jni"); which translates to invoke-virtual in compiled ...
user avatar
3 votes

Need to extend the list of libraries that a shared (.so) library uses

The required shared libraries are stored as DT_NEEDED entries in the dynamic section of the executable. This entry, in turn, points into the dynamic string table. So, to add another library, you will ...
user avatar
  • 34.6k
3 votes

Why does `ldd` and `(gdb) info sharedlibrary` show a different library base address?

First, ASLR will load the library at a (slightly) different address with each invocation, to help protect against malware. This is why the addresses between ldd and gdb are different, and why they may ...
user avatar
2 votes
Accepted

How to determine which thread implementation binary compiled with

There are many ways, but I'll cite two. Usually, a binary file, if not stripped, contains symbols (function names, variable names, ...). These symbols are usually used to ease debugging and are ...
user avatar
  • 2,603
2 votes

How to find the version number of Android Ad libraries from reverse engineered apps?

There is no perfect answer for this, it will greatly depend on your tolerance to false positives. Though there are three answers that come to mind depending on you level of effort you're willing to ...
user avatar
  • 338
2 votes

Function dependencies in static libraries

You are actually asking multiple different questions here : [Regarding static linking only a few functions of a library] Are there any general reasons why this is not a good idea or impossible?...
user avatar
  • 565
2 votes

How to figure out which library a native JNI function is calling?

It's been a while, but there should be a static code block with the .so they are calling. I would need to disassemble a file using a shared library. It will resemble: https://stackoverflow.com/...
user avatar
  • 168
2 votes
Accepted

Antidebug/reverse engineering targeted for libraries

To the best of my knowledge theoretically most obfuscation techniques are also applicable to libraries, but there are considerable downsides: Slowdown and increased support-difficulties. Please note ...
user avatar
  • 2,806
2 votes

How to detect only external-module calls?

I'd recommend using API Monitor for this. You can limit its trace to only display calls to GDI functions and DirectDraw functions:
user avatar
2 votes

How to find the executable code of the native method in the library * .so? (Android)

There are two different ways to define JNI methods. The easiest way is to just give the functions special names like in the examples you've seen. However, this is not necessary. JNI methods can also ...
user avatar
  • 1,972
2 votes
Accepted

How can I see when a library is being called in Android?

It is a bit unclear what do you mean by "library being called". If you want to know when the library is loaded, you may look for references to System.loadLibrary(string) or System.load(...
user avatar
  • 686
2 votes
Accepted

How to call a func in an executable binary?

LIEF If the binary is a PIE, exporting functions via the LIEF binary instrumentation framework should allow you to call the function you are interested in as if it was a function in a shared object. ...
user avatar
  • 6,819
1 vote
Accepted

How to view the functions of a loaded library in x64dbg

You can either press Ctrl+G and type LoadLibraryA to land at this function address, or if you want to list all the functions from kernel32.dll you can go to the Symbols tab like this: From there you ...
user avatar
  • 686
1 vote

Reversing a .LIB file

I guess the files you found are index files. They contain the list of all pictures, ebooks, playlists (m3u) and so on, so the player doesn't have to open each individual file when you search for a ...
user avatar
1 vote
Accepted

macOS under M1, cannot find library

On ARM macOS, like on iOS, most of the common dylibs are no longer shipped as separate files, but are bundled into the dyld shared cache. You can usually find the caches in /System/Library/dyld/.
user avatar
  • 34.6k
1 vote

Fixing Indirect Jump as Call?

goto the address, press d to decompile. if it looks like sensible code, then press F to make it a function. This is common for function pointers, windows COM, callbacks etc. If your on an embedded ...
user avatar
  • 11
1 vote

Ghidra : iOS Application : Mach-O binary -> Symbol files of dylib or framework are not generated

It's very likely that Ghidra doesn't know how to read the symbols from the dyld_shared_cache. You can try to use a different tool like IDA PRO, Rizin or radare2 or Cutter, etc. But, which binary are ...
user avatar
1 vote

Cannot disassemble exported functions

This is not true for all functions in kernel32.dll, but for specific functions that are imported from other dlls. You have to find out where the function is imported from and then look at the ...
user avatar
  • 113
1 vote

OTOOL alternative for linux

I am in a similar position carrying out iOS related work on an Ubuntu host. The suggestions to use objdump will not work unless it has been compiled specifically with support of Mach-O binaries which ...
user avatar
  • 95
1 vote

OTOOL alternative for linux

If you have stripped binaries there's little you can do regardless of the platform you're on. To view disassembled code on Linux, as you would with Otool on Mac, you can use objDump: objdump --...
user avatar
1 vote

Is there a good place to search information about known DLLs?

if they are Microsoft dlls you are interested to know about then ms normally provides a concise description of its dlls functionality in it FileVersion information also other legitimate dlls ...
user avatar
  • 14.8k
1 vote

How to detect internal and shared libraries used in an executable file?

I can see two paths for moving forward. First, following your current approach, you can probably detect version information and library automatically in the strings you find. This is not a ...
user avatar
  • 11.3k
1 vote

Antidebug/reverse engineering targeted for libraries

I think all anti-debug and anti-reversing techniques are also applicable to shared and static libraries. Shared libraries are still code, just placed in a different file format. I guess people don't ...
user avatar
1 vote
Accepted

ldd doesn't show dynamic libraries

They can load their dynamic libraries dynamically by using dlopen and dlsym functions. Here is the man page of dlsym and usage example
user avatar
  • 7,700
1 vote

How to verify that an Android Application & Library is correctly obfuscated

I'm not sure what you mean by verify if the code has been properly obfuscated, but you could do a simple differential analysis. Compile the source without proguard and identify the important code, and ...
user avatar
  • 355

Only top scored, non community-wiki answers of a minimum length are eligible