0

I have a couple of questions about the Ghidra

  1. I am analyzing a binary file and in the binary it uses a functions from libstdc++. What is the best way to add the signatures of functions from "libstdc++" into my binary file ?

  2. I see in the "External program" window multiple so files, from where Ghidra takes this so files ?

prtqwsq
  • 1
  • 1

1 Answers1

1

  1. The easiest way is to get a build of libstdc++ with DWARF debug symbols e.g. by downloading it from the Debian repositories https://packages.debian.org/buster/libstdc++6-7-dbg. In general you can also compile it yourself, but for common libraries Debian tends to have a version built with debug symbols already. You can then auto analyse it (or run only the DWARF debug analyses), and export a GDT archive via "Capture Function Signatures", either as a file archive or project archive, and then load this in your desired binary and apply it.

  2. Ghidra searches some folders for libraries when a binary is imported, I already described the details in this answer (with screenshots)

Florian Magin
  • 1,444
  • 6
  • 22