0

Currently, I check for imported functions (.plt) using objdump:

objdump -D -j .plt myprog | grep '@plt'

However, it doesn't seem right to have objdump output annotated disassembly to grep to list imported (.plt) functions.

To check exported functions, I use readelf -s myprog, but the imported .plt functions doesn't show up here?

How can I list all imported (.plt) function in an ELF executable?

  • nm -D your_prog | grep -w U – mosvy Jun 23 '19 at 11:42
  • Thanks @mosvy - why do .plt symbols correspond to "U" The symbol is undefined? Is it because, it is first resolved at runtime using dynamic linking? Also, could .plt symbols be output by readelf? – Shuzheng Jun 23 '19 at 11:50
  • 1. nm -D is more general than ELF and will tell you about all dynamic symbols; the undefined ones from an executable are of course those that should be resolved at run time. 2. I don't know about readelf -- please post a reproducible testcase instead of some vague claims. In any case, your objdump | grep plt thing will display __libc_start_main@ as printf@plt+.. with a stripped binary, so it's completely useless. 3. the binutils tools make it unnecessarily hard to rev-eng stripped binaries -- every time I had the need, I had to put up my own thing, instead of fighting with them. – mosvy Jun 23 '19 at 12:20
  • @mosvy - thanks, just curiousity: What did you use instead of binutils for stripped binaries? Something you coded yourself? Also, for a stripped binary, all symbols will be lost, so there won't be any __libc_start_main@, neither printf@plt, right? – Shuzheng Jun 23 '19 at 17:05

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.