Executable Symbols

Tables

Symbols are names identifying addresses of a binary.

  • Have a type, such as Function, and including Undefined.

  • E.g. functions create symbols, especially external functions (puts).

ELF files have two symbol tables.

  • .dynsym: symbols which will be allocated to memory when the program loads.

    • In the example, puts is provided by libc, required for operation, and exists as a dynamic symbol.

  • .symtab: contains all symbols, including many used for linking and debugging, but not related to code required for execution.

    • These areas will not be allocated (mapped) to RAM.

    • Extremely useful to identify the name of functions/sections when reversing!

Stripping

Only symbols in the .dyntab are required.

  • Identify allocated sections.

  • Identify symbols that must be resolved in external libraries.

  • Used for Dynamic Linking when the program is loaded.

Stripping is the process of removing unused symbols and code from a binary.

  • Stripped binaries take less space, and are not reversed so easily.

    • There is no hints about the purpose of a function from its name.

Last updated