9
votes
Accepted
Find function in a stripped dynamic ELF library
There're two broad ways in which you can declare JNI functions.
The first is the more obvious way in which the JNI function has to follow a specific naming convention like JNIEXPORT void JNICALL ...
- 5,860
8
votes
Why does `ldd` and `(gdb) info sharedlibrary` show a different library base address?
ldd
The program ldd is wrong for a few reasons.
First, ldd is not meant to be accurate for determining load addresses. Use the environment variable LD_TRACE_LOADED_OBJECTS.
Second, ldd will never ...
- 2,277
7
votes
WinDbg Debugging without symbols
Make sure if you have the correct breakpoint address
issue lm an exe without symbol will be shown as
0:000> lm
start end module name
00400000 0040f000 image00400000 (no symbols) ...
- 15k
5
votes
Symbols visible in EXE file without PDB
dynamic_cast requires a runtime check that the cast is valid at execution time and the usual implementation uses RTTI (Run-time type information) attached to all classes participating in the casts. ...
- 34.9k
5
votes
Accepted
Load dSYM symbols in Hopper
It's possible since Hopper v3, under File > Read Debug Symbols File...
- 163
5
votes
Accepted
How can you get the symbol visibility with radare?
afaik, Symbol Visibility is not available in radare2.
The closest to this you can get are the symbol bindings and types. You can do this with the is command which is responsible for showing symbols.
$...
- 8,659
5
votes
How to configure IDA to load .pdb files from Microsoft public symbol server?
It seems IDA recognizes _NT_SYMBOL_PATH so all you only need to is:
Start -> RUN -> RUNDLL32 sysdm.cpl,EditEnvironmentVariables
Under "System variables", add an entry named "_NT_SYMBOL_PATH" and set ...
- 151
4
votes
Accepted
How to strip more than symbols?
It is possible that you are using RTTI.
Try compiling your code with option -fno-rtti.
Update: It is really RTTI.
I don't know how exactly it works, but I succeeded to remove those strings as ...
- 7,875
4
votes
Accepted
In a Mach-O executable, how can I find which function a stub targets?
I wrote a Python script that parses entry points and imports from a Mach-O executable for one of my projects. The trick is to parse the LC_DYLD or LC_DYLD_ONLY loader commands. These two commands ...
- 281
4
votes
In a Mach-O executable, how can I find which function a stub targets?
the numeric argument is is an offset into the "compressed dyld info" stream of bytecodes. see https://stackoverflow.com/a/8836580 (iOS/arm but still applies)
- 34.9k
4
votes
Accepted
Radare can't seek to _start symbol
You can't seek to any symbol that shown by is, you can only seek to "flags" or addresses.
The f command is used to list all the flags from the selected flagspace. By default all the available ...
- 8,659
4
votes
Accepted
Missing Symbols RtlGetFrame, RtlPushFrame, RtlPopFrame
Those functions are exported from ntdll.dll file. To link with those functions, add #pragma comment (lib, "ntdll.lib") in the source file. Or in Visual Studio, first check the active Configuration and ...
- 1,469
3
votes
Accepted
Rebuilding a symbol table for a firmware binary
It sounds like you aren't sure what you want to do exactly. Is there any part of the firmware you want to reverse engineer in particular? I suggest you first start by reading some blog posts on ...
3
votes
Accepted
How does IDA pro generate function names?
I've seen 4 naming conventions being used:
vNNN() when decompiling ARM binaries (i.e.: Android JNI code) - not sure how it numbers them as it doesn't seem it's related to their position or address ...
- 336
3
votes
Accepted
IDA fails to load Symbols from EXE on Linux
A common issue is missing symsrv.dll. Please make sure you have it on the remote machine and that win32_remote.exe can find it.
You can also append -z10000 to the command line in order to get more ...
- 2,265
3
votes
Why does `ldd` and `(gdb) info sharedlibrary` show a different library base address?
First, ASLR will load the library at a (slightly) different address with each invocation, to help protect against malware. This is why the addresses between ldd and gdb are different, and why they may ...
- 12.7k
3
votes
Accepted
ida identifies library function as regular function
There can be multiple reasons.
the FLIRT signatures which have been loaded automatically do not have a pattern for this specific function. You can check which signatures have been applied and try ...
- 34.9k
2
votes
How to strip more than symbols?
Try compiling your program as a static assembly, and strip it using the compiler. You won't find any 'cling' references in the resultant executable.
$ g++ -static -s cling.cpp -o cling
$ ls -l ...
- 266
2
votes
How do I find non-exported symbols of a binary?
You would need to ask the developers of those Android / iOS apps for the symbols. It's very unlikely that they've made their apps' symbols publicly available.
However, keep in mind that although ...
- 20.4k
2
votes
Accepted
Reuse symbols in disassembling/reassembling a C++ program
old question, but I think I can answer a part of it
why the name of symbol _ZTTSt14basic_ifstreamIcSt11char_traitsIcEE
modified to _ZTTSt14basic_ifstreamIcS
I think you've just run into as ...
- 34.9k
2
votes
Resolving symbols of statically linked libraries in a binary
what do you mean by resolve? if one has access to a some flavor of *nix one could run the nm command on the binaries in question.
nm -a
That command will expose any symbols used in the binaries. ...
- 93
2
votes
Which libraries exist for PDB (symbol file) generation?
microsoft recently released some headers in github to help the clang / llvm toolset take a look Microsoft Pdb Information in GitHub
clang llvm codeview emission rfc mailing list thread
- 15k
2
votes
What is an "addend"?
I think it just means "a number that's added", and in this case "the number that's added to the base load address (or segment load address) to compute the final pointer for this relocation".
Let's ...
- 160
2
votes
How can I view the dynamic symbol table of a running process?
The structure holding the list of loaded shared objects is called link_map and is stored inside the dynamic linker (rtld or ld.so, depending on the platform).
AFAIK there is no official standard for ...
- 34.9k
2
votes
Accepted
What is an "addend"?
Augend is a term that means a number that is subject to addition
Addend is the number that you will be adding.
From Dictionary.com,
Have you ever found yourself staring at a piece of paper with “3 ...
- 1,664
2
votes
IDA 7.0 (free) fails to load symbols with message "DWARF: Cannot determine location of DWARF info" during debugging
I fixed it by
Setting the environment variable
_NT_SYMBOL_PATH=srv*c:\pdb_cache*http://msdl.microsoft.com/download/symbols
then tick the "auto load PDB files" in Debugger Options
- 21
2
votes
Accepted
Why might nm find a few undefined symbols that I can't see with xxd?
The recent updates to the Mach-O format (the LC_DYLD_INFO_ONLY command) have an option of encoding the export symbol information as a trie structure. In such case it's possible that the symbol name ...
- 34.9k
1
vote
What is an "addend"?
Addend is simply "a number to be added to another", according to Merian Webster.
- 115
1
vote
Accepted
Why can't gdb find symbol which IDA can?
The file you provided is a stripped elf executable. A related question can be found here. The main issue is that a stripped elf file has no main symbol. Instead, the loader uses the e_entry header ...
- 2,826
Only top scored, non community-wiki answers of a minimum length are eligible