2

LIEF If the binary is a PIE, exporting functions via the LIEF binary instrumentation framework should allow you to call the function you are interested in as if it was a function in a shared object. Example: LIEF - Transforming an ELF executable into a library LD_PRELOAD If the binary is dynamically linked and contains code for setting up the standard C ...


1

I think you are looking for something called FLIRT signature. You can use them to identify common definitions from various libraries. You just need to download the flirt signatures, and let IDA do the work. A public flirtdb repo can be found on github here. You can search for others on google too. Edit: My bad, totally missed out the ARM linux part. ...


1

I guess the files you found are index files. They contain the list of all pictures, ebooks, playlists (m3u) and so on, so the player doesn't have to open each individual file when you search for a specific song or video. This means these files are most like a custom database format. The first header line might be something like the "database name", ...


1

On ARM macOS, like on iOS, most of the common dylibs are no longer shipped as separate files, but are bundled into the dyld shared cache. You can usually find the caches in /System/Library/dyld/.


1

goto the address, press d to decompile. if it looks like sensible code, then press F to make it a function. This is common for function pointers, windows COM, callbacks etc. If your on an embedded system, you might need to check your memory map to tell the compiler to look in the correct regions of memory to find code. For example the call could be from ...


1

It's very likely that Ghidra doesn't know how to read the symbols from the dyld_shared_cache. You can try to use a different tool like IDA PRO, Rizin or radare2 or Cutter, etc. But, which binary are you trying to reverse? Do you know which functions do you want to trace? You can use the tool jtool, read more on jtool - Taking the O out of otool(1), and so ...


1

I am in a similar position carrying out iOS related work on an Ubuntu host. The suggestions to use objdump will not work unless it has been compiled specifically with support of Mach-O binaries which is not normally the case on Linux. jtool2 has by far been found to be the best Linux based equivalent for me and the commands you have listed should be ...


1

If you have stripped binaries there's little you can do regardless of the platform you're on. To view disassembled code on Linux, as you would with Otool on Mac, you can use objDump: objdump --disassemble-all thebinary


Only top voted, non community-wiki answers of a minimum length are eligible