Executable Symbols
Tables
Symbols are names identifying addresses of a binary.
Have a type, such as Function, and including Undefined.
E.g. functions create symbols, especially external functions (puts).
ELF files have two symbol tables.
.dynsym: symbols which will be allocated to memory when the program loads.
In the example, puts is provided by libc, required for operation, and exists as a dynamic symbol.
.symtab: contains all symbols, including many used for linking and debugging, but not related to code required for execution.
These areas will not be allocated (mapped) to RAM.
Extremely useful to identify the name of functions/sections when reversing!
Stripping
Only symbols in the .dyntab are required.
Identify allocated sections.
Identify symbols that must be resolved in external libraries.
Used for Dynamic Linking when the program is loaded.
Stripping is the process of removing unused symbols and code from a binary.
Stripped binaries take less space, and are not reversed so easily.
There is no hints about the purpose of a function from its name.
Last updated