TransWikia.com

How to find function start in stripped binary?

Reverse Engineering Asked on December 30, 2021

Given C code, are the function addresses from the ELF the same as those in the stripped version?

I don’t have any specific code in mind. Just trying to learn in general how to find the function beginning (and possibly end) in the stripped binary given the original code.

One Answer

In a nutshell, stripping a binary means removing sections containing symbol and debug information from the file. These sections lie at the end of the binary, separate from the code. Removing this information has no bearing on the code itself, so the locations of functions in the file (their file offsets) will be the same after stripping the binary. Function addresses (their location in virtual memory), on the other hand, may either be hardcoded or position independent; it depends on how the binary was compiled (this is also unaffected by stripping symbol info).

Finding the boundaries of functions in stripped binaries is an undecidable problem, but workarounds and heuristics exist, such as a signature-based approach to function detection. Here are some examples:

  1. IDA FLIRT essentially uses byte patterns to create function signatures
  2. Ghidra's FunctionID feature takes mnemonic and operand type into account when hashing instructions to match functions to their well-known name
  3. JEB's disassembler creates function signatures by hashing the assembly (not binary code) of the function with a custom hashing algorithm.
  4. BinaryNinja's Signature Library

Here is an interesting article on the subject: Architecture Agnostic Function Detection in Binaries

Answered by julian on December 30, 2021

Add your own answers!

Ask a Question

Get help from others!

© 2024 TransWikia.com. All rights reserved. Sites we Love: PCI Database, UKBizDB, Menu Kuliner, Sharing RPP