5

Doing some messing around with ELF (of both the x86 and ARM varieties).

Associating symbol names with entries in the .got section is straightforward. Find the .got section, find the relocation section .rel.plt/.rela.plt whose .sh_info contains the index of the .got, and find the symbol section .dynsym that contains the symbol names.

Everything lines up nicely between these sections, and I can accurately assign symbol names to entries in the .got.

However, I also want names for the stubs in the .plt section. A rough percentage of the time, symbols for the .plt can be inferred based on the ordering of .got symbols, and an offset from the base of the .plt section. For whatever reason, occasionally this is not the case.

Binutils objdump can accurately generate them for x86, and IDA can accurately generate them for x86 and ARM (both without -g debugging symbols). How are these generated?

In the case of IDA, I could reasonably assume there's some advanced logic going on based on interpretation of the instructions in the .plt, but I know that must not be the case for objdump.

Zach Riggle
  • 2,337
  • 1
  • 16
  • 28

1 Answers1

4

See this thread. Basically, they rely on the fact that the order of PLT relocations matches the order of the stubs in .plt section, and the stubs are all of the same size.

On some platforms you can also use st_value of the symbol entry in the dynamic symbol table.

IDA indeed usually does not rely on the order of symbols/relocations but checks the actual instructions in the stub.

Igor Skochinsky
  • 36,553
  • 7
  • 65
  • 115