Hot answers tagged

9 votes
Accepted

Find function in a stripped dynamic ELF library

There're two broad ways in which you can declare JNI functions. The first is the more obvious way in which the JNI function has to follow a specific naming convention like JNIEXPORT void JNICALL ...
0xec's user avatar
  • 6,050
6 votes
Accepted

In a Mach-O executable, how can I find which function a stub targets?

I wrote a Python script that parses entry points and imports from a Mach-O executable for one of my projects. The trick is to parse the LC_DYLD or LC_DYLD_ONLY loader commands. These two commands ...
zneak's user avatar
  • 321
5 votes

How to configure IDA to load .pdb files from Microsoft public symbol server?

It seems IDA recognizes _NT_SYMBOL_PATH so all you only need to is: Start -> RUN -> RUNDLL32 sysdm.cpl,EditEnvironmentVariables Under "System variables", add an entry named "_NT_SYMBOL_PATH" and set ...
Steven Liang's user avatar
5 votes

Symbols visible in EXE file without PDB

dynamic_cast requires a runtime check that the cast is valid at execution time and the usual implementation uses RTTI (Run-time type information) attached to all classes participating in the casts. ...
Igor Skochinsky's user avatar
  • 36.4k
5 votes
Accepted

How can you get the symbol visibility with radare?

afaik, Symbol Visibility is not available in radare2. The closest to this you can get are the symbol bindings and types. You can do this with the is command which is responsible for showing symbols. $...
Megabeets's user avatar
  • 8,919
4 votes
Accepted

Radare can't seek to _start symbol

You can't seek to any symbol that shown by is, you can only seek to "flags" or addresses. The f command is used to list all the flags from the selected flagspace. By default all the available ...
Megabeets's user avatar
  • 8,919
4 votes
Accepted

Missing Symbols RtlGetFrame, RtlPushFrame, RtlPopFrame

Those functions are exported from ntdll.dll file. To link with those functions, add #pragma comment (lib, "ntdll.lib") in the source file. Or in Visual Studio, first check the active Configuration and ...
Biswapriyo's user avatar
  • 1,559
4 votes
Accepted

How to load a PDB file into x64dbg?

You can use symload/loadsym command. In the x64dbg console type: symload pdbconsoleapplication1,symbols\pdbconsoleapplication1.pdb,[0/1] With the last argument, you can control if the validation of ...
Paweł Łukasik's user avatar
3 votes
Accepted

ida identifies library function as regular function

There can be multiple reasons. the FLIRT signatures which have been loaded automatically do not have a pattern for this specific function. You can check which signatures have been applied and try ...
Igor Skochinsky's user avatar
  • 36.4k
3 votes

How can I view the dynamic symbol table of a running process?

The structure holding the list of loaded shared objects is called link_map and is stored inside the dynamic linker (rtld or ld.so, depending on the platform). AFAIK there is no official standard for ...
Igor Skochinsky's user avatar
  • 36.4k
3 votes
Accepted

Rebuilding a symbol table for a firmware binary

It sounds like you aren't sure what you want to do exactly. Is there any part of the firmware you want to reverse engineer in particular? I suggest you first start by reading some blog posts on ...
Hitechcomputergeek's user avatar
2 votes

Resolving symbols of statically linked libraries in a binary

what do you mean by resolve? if one has access to a some flavor of *nix one could run the nm command on the binaries in question. nm -a That command will expose any symbols used in the binaries. ...
Div's user avatar
  • 93
2 votes

Which libraries exist for PDB (symbol file) generation?

microsoft recently released some headers in github to help the clang / llvm toolset take a look Microsoft Pdb Information in GitHub clang llvm codeview emission rfc mailing list thread
blabb's user avatar
  • 16.3k
2 votes
Accepted

Reuse symbols in disassembling/reassembling a C++ program

old question, but I think I can answer a part of it why the name of symbol _ZTTSt14basic_ifstreamIcSt11char_traitsIcEE modified to _ZTTSt14basic_ifstreamIcS I think you've just run into as ...
Igor Skochinsky's user avatar
  • 36.4k
2 votes
Accepted

What is an "addend"?

Augend is a term that means a number that is subject to addition Addend is the number that you will be adding. From Dictionary.com, Have you ever found yourself staring at a piece of paper with “3 ...
Evan Carroll's user avatar
  • 1,779
2 votes

IDA 7.0 (free) fails to load symbols with message "DWARF: Cannot determine location of DWARF info" during debugging

I fixed it by Setting the environment variable _NT_SYMBOL_PATH=srv*c:\pdb_cache*http://msdl.microsoft.com/download/symbols then tick the "auto load PDB files" in Debugger Options
sklaw's user avatar
  • 21
2 votes

What is an "addend"?

I think it just means "a number that's added", and in this case "the number that's added to the base load address (or segment load address) to compute the final pointer for this relocation". Let's ...
Rup's user avatar
  • 190
2 votes
Accepted

Why might nm find a few undefined symbols that I can't see with xxd?

The recent updates to the Mach-O format (the LC_DYLD_INFO_ONLY command) have an option of encoding the export symbol information as a trie structure. In such case it's possible that the symbol name ...
Igor Skochinsky's user avatar
  • 36.4k
1 vote

Where Can I Get .PDB files for Windows OS Components?

official way is as pointed out by other answers use symchk.exe from windbg installation but you can also fetch it by putting together few dbghelp and winsock functions find below a poc that uses wget....
blabb's user avatar
  • 16.3k
1 vote
Accepted

How to retrieve name of a variable defined in the data segment in IDA when no process is attached?

You need to set ds to the actual segment value used by the program. Usually it's one of the segments near the end. I suggest you to check which of the segments has something fitting at 8401h, or try ...
Igor Skochinsky's user avatar
  • 36.4k
1 vote

How to retrieve name of a variable defined in the data segment in IDA when no process is attached?

You can press Ctrl+G and check the different settings of the segment registers. You can press Alt+G to edit the segment registers.
macro_controller's user avatar
1 vote

IDA pro not showing function names properly

You can't simply name a function with these characters. However, IDA can read mangled names and "demangle" them, showing their prototype with the C++ original symbols. Basically, you want to write ...
Yotamz's user avatar
  • 924
1 vote

GCC is not recognizing symbol table in my hand-made ELF file

I tried running the same commands as you with the file you provided but it failed in the same way as yours. However with a newer hellow.c as such char hello[] = "Hello World"; with the following ...
sudhackar's user avatar
  • 2,639
1 vote

IDA 7.0 (free) fails to load symbols with message "DWARF: Cannot determine location of DWARF info" during debugging

you must load pdb file when you pause this application, it must be paused state.
boo's user avatar
  • 111
1 vote
Accepted

How to find ELF symbol table reference?

Strangely enough, the position 096B3D47 is just a few lines above the above excerpt... ... and the instruction before that address is a call instruction. Right? This kind of instructions is used for ...
Martin Rosenau's user avatar
1 vote

What is an "addend"?

Addend is simply "a number to be added to another", according to Merian Webster.
Joezer's user avatar
  • 115
1 vote
Accepted

What is the difference between a GLOBAL symbol and NONE?

PE Binding "GLOBAL" and "NONE" are values of the "Bind" column in radare2's symbol table. As @blabb correctly described, whenever you look at the "Exports" through radare2 you'll see the value "...
Megabeets's user avatar
  • 8,919
1 vote

What is the difference between a GLOBAL symbol and NONE?

exported functions in a binary are denoted by GLOBAL imported function in a binary are denoted by NONE :\>rabin2 -i ..\..\miscinfo\Debug\tzinfo.dll | grep -i Mod 003 0x10016008 NONE FUNC KERNEL32....
blabb's user avatar
  • 16.3k
1 vote
Accepted

How to demangle symbols with starting with "@@"?

IDA demangles @@Unit1@Initialize as __linkproc__ Unit1::Initialize and looking for __linkproc__ yields some clues: Modifiers (mutually exclusive) UM_LINKER_PROC Special linker procedure (#pragma ...
Igor Skochinsky's user avatar
  • 36.4k

Only top scored, non community-wiki answers of a minimum length are eligible