9
There're two broad ways in which you can declare JNI functions.
The first is the more obvious way in which the JNI function has to follow a specific naming convention like JNIEXPORT void JNICALL Java_com_app_foo_bar. You can easily identify such functions using readelf.
The other not so obvious way is to use RegisterNatives. Here your functions can have ...
8
ldd
The program ldd is wrong for a few reasons.
First, ldd is not meant to be accurate for determining load addresses. Use the environment variable LD_TRACE_LOADED_OBJECTS.
Second, ldd will never be correct with ASLR enabled as Guntram showed. You can disable this pretty trivially if you have sudo access.
$ LD_TRACE_LOADED_OBJECTS=1 /bin/bash | grep ...
8
TL;DR you can call anything, locating the right part of code is the hard part.
export table
If you mean 'just as Windows does', then you mean the functions of the DLL that are available to the others, ie the exported ones? in this case, you need to parse the export table - check pefile for a readable and reliable implementation.
locating any function
IDA
If ...
7
Make sure if you have the correct breakpoint address
issue lm an exe without symbol will be shown as
0:000> lm
start end module name
00400000 0040f000 image00400000 (no symbols)
compare the NtHeader->AddresssOfEntrypoint with @$exentry
0:000> r $t0 = image00400000
0:000> ?? ((ntdll!_IMAGE_NT_HEADERS *) @@( poi( @$t0 + 0x3c ...
7
This page contains an IDC script And a Windbg Extension to dump the names and a WinDbg extension to load those names into WinDbg.
Edit
To Address the comment by @OzgurH
yes the idc as well as AddSyntheticSymbol are slow in fact getting a list of Names along with the boundaries from idc is tedious
(also it was done in idafree 5 which isn't available for ...
5
dynamic_cast requires a runtime check that the cast is valid at execution time and the usual implementation uses RTTI (Run-time type information) attached to all classes participating in the casts. However, since it's not easy to narrow down the classes that may be possibly casted, in practice the compiler emits RTTI for all polymorphic classes (i.e. those ...
5
It's possible since Hopper v3, under File > Read Debug Symbols File...
5
afaik, Symbol Visibility is not available in radare2.
The closest to this you can get are the symbol bindings and types. You can do this with the is command which is responsible for showing symbols.
$ r2 /bin/echo
-- What do you want to debug today?
[0x00401800]> is
[Symbols]
050 0x00007228 0x00607228 GLOBAL OBJ 8 stdout
051 0x00007220 0x00607220 ...
4
I worked with some types of symbol tables. All these types are very different and can not be defined as something that allows automatic detection. It can be some kind of list of tuples like (pointer to name, type, pointer to object, [something else]). There are a lot of other variants also.
Any time I succeeded to recognize symbol table it was done by ...
4
It is possible that you are using RTTI.
Try compiling your code with option -fno-rtti.
Update: It is really RTTI.
I don't know how exactly it works, but I succeeded to remove those strings as follows:
$ g++ -Xlinker -unexported_symbol -Xlinker "*" -o executable file.cpp
$ strip executable
(This was found at https://stackoverflow.com/questions/1931626/...
4
I wrote a Python script that parses entry points and imports from a Mach-O executable for one of my projects. The trick is to parse the LC_DYLD or LC_DYLD_ONLY loader commands. These two commands encode three import tables: bound symbols, weak symbols, and lazy symbols.
struct dyld_info_command {
uint32_t cmd;
uint32_t cmdsize;
uint32_t rebase_off;
...
4
the numeric argument is is an offset into the "compressed dyld info" stream of bytecodes. see https://stackoverflow.com/a/8836580 (iOS/arm but still applies)
4
You can't seek to any symbol that shown by is, you can only seek to "flags" or addresses.
The f command is used to list all the flags from the selected flagspace. By default all the available flagspaces are selected. For example, in order to select the 'symbols' flagspace and list only the flags inside it, use:
[0x004049a0]> fs symbols
[0x004049a0]> ...
4
Those functions are exported from ntdll.dll file. To link with those functions, add #pragma comment (lib, "ntdll.lib") in the source file. Or in Visual Studio, first check the active Configuration and Platform. Then add the library in Project > Properties > Linker > Input > Additional Dependencies. For example, like this %(AdditionalDependencies); ntdll.lib. ...
3
It sounds like you aren't sure what you want to do exactly. Is there any part of the firmware you want to reverse engineer in particular? I suggest you first start by reading some blog posts on devttys0.com, as he seems like an excellent source for information about reverse-engineering router firmwares.
If a binary contains symbols, IDA Pro should ...
3
I've seen 4 naming conventions being used:
vNNN() when decompiling ARM binaries (i.e.: Android JNI code) - not sure how it numbers them as it doesn't seem it's related to their position or address within the binary.
sub_HHHHHH() when decompiling x86/64 binaries (i.e.: for Windows, OSX) with the actual address on the name
_name/__name() for functions IDA is ...
3
First, ASLR will load the library at a (slightly) different address with each invocation, to help protect against malware. This is why the addresses between ldd and gdb are different, and why they may be even different each time you run gdb.
If i just grep for the libc executable segment on my system (64 bit, as i didn't have a 32 bit system handy):
$ grep ...
3
A common issue is missing symsrv.dll. Please make sure you have it on the remote machine and that win32_remote.exe can find it.
You can also append -z10000 to the command line in order to get more output from the MS-DIA libraries.
Thanks to HexRays for this answer.
3
There can be multiple reasons.
the FLIRT signatures which have been loaded automatically do not have a pattern for this specific function. You can check which signatures have been applied and try loading additional ones via Signatures view (Shift-F5).
the function pattern was conflicting with another function(s) and has been dropped from the final signature ...
2
As pointed out in the first comment: firmware may have a custom format, therefore there is no general way to extract the symbols table from it. However,
you can extract the debugging symbols from an ELF binary using objcopy. The command should look something like:
objcopy --only-keep-debug binary_file output_file_with_debug_symbols
If you inspect the ...
2
Probably with full intent from MS, not only does syscall numbering change between versions, but also many DLL ordinal values do too. Need to bind to WIN32 and use the full function name if you want your code to work across os releases.
2
Try compiling your program as a static assembly, and strip it using the compiler. You won't find any 'cling' references in the resultant executable.
$ g++ -static -s cling.cpp -o cling
$ ls -l cling*
-rwxr-x--- 1 lornix lornix 1,313,792 Jun 22 19:19 cling*
-rw-r----- 1 lornix lornix 222 Jun 22 19:16 cling.cpp
$ strings -a cling | grep -ic cling
0
2
You would need to ask the developers of those Android / iOS apps for the symbols. It's very unlikely that they've made their apps' symbols publicly available.
However, keep in mind that although symbols are helpful, they aren't required to reverse engineer an app.
2
what do you mean by resolve? if one has access to a some flavor of *nix one could run the nm command on the binaries in question.
nm -a
That command will expose any symbols used in the binaries. Typically if you see something of the order T or Text next to a symbol it means its available to be called and its probably a function. Typically if you see a ...
2
microsoft recently released some headers in github to help the clang / llvm toolset take a look Microsoft Pdb Information in GitHub
clang llvm codeview emission rfc mailing list thread
2
The structure holding the list of loaded shared objects is called link_map and is stored inside the dynamic linker (rtld or ld.so, depending on the platform).
AFAIK there is no official standard for it but the most common implementation (glibc) uses the GOT[1] entry to store a pointer to the link map and the PLT stubs passes it to the dynamic symbol ...
2
old question, but I think I can answer a part of it
why the name of symbol _ZTTSt14basic_ifstreamIcSt11char_traitsIcEE
modified to _ZTTSt14basic_ifstreamIcS
I think you've just run into as terminal width limit. By default readelf limits output lines to 80 characters, you neeed to pass -W to disable it:
-W --wide Allow output width to ...
2
I think it just means "a number that's added", and in this case "the number that's added to the base load address (or segment load address) to compute the final pointer for this relocation".
Let's imagine that when we load our binary into memory at 0x400000 we have a pointer at 0x401234 that points to 0x405678. (If instead we loaded the binary at 0x800000 ...
2
Augend is a term that means a number that is subject to addition
Addend is the number that you will be adding.
From Dictionary.com,
Have you ever found yourself staring at a piece of paper with “3 + 4” written on it, and wondered ‘what is the proper term for each of these two respective quantities?’ No? The first number is the augend and the number that ...
Only top voted, non community-wiki answers of a minimum length are eligible