Question

I'd like to know how can I match the external functions called by a binary with their linked shared library. For example, I can see the functions looking at the .plt section of a disassembled file, and I can find out the used libraries using ldd (or looking at the ELF dynamic section); but how can I match each function with its library?

Was it helpful?

Solution

I followed the Laszio hint and I've created a little python function which get a binary file name and by mixing ldd and nm, returns a dictionary which contains the external functions with their shared libraries. Maybe it is a little confusing, but it works :) Here it is the code

def get_dynamicOBJ(filename):
   p_nm = subprocess.Popen(["nm", "-D", filename], stdout=subprocess.PIPE, stderr=subprocess.PIPE)
   result_nm = p_nm.stdout.readlines()
   p_ldd = subprocess.Popen(["ldd", filename], stdout=subprocess.PIPE, stderr=subprocess.PIPE)
   result_ldd = p_ldd.stdout.readlines()
   dyn = {}

   for nm_out in result_nm:
       sym_entry = nm_out.split()
       if len(sym_entry) >= 2 and sym_entry[0 if len(sym_entry) == 2 else 1] == "U":
           sym = sym_entry[1 if len(sym_entry) == 2 else 2]
           for lld_out in result_ldd:
               lib_entry = lld_out.split()
               if "=>" in lld_out and len(lib_entry) > 3: # virtual library
                   lib = lib_entry[2]
                   ls_nm = subprocess.Popen(["nm", "-D", lib], stdout=subprocess.PIPE, stderr=subprocess.PIPE)
                   result_lsnm = ls_nm.stdout.readlines()
                   for ls_nm_out in result_lsnm:
                       lib_symbol = ls_nm_out.split()
                       if len(lib_symbol) >= 2 and lib_symbol[0 if len(lib_symbol) == 2 else 1] == "T":                            
                           if sym == lib_symbol[1 if len(lib_symbol) == 2 else 2]:
                               dyn[sym] = lib

   return dyn
Licensed under: CC-BY-SA with attribution
Not affiliated with StackOverflow
scroll top