Search code examples
linuximportdllimportfile-formatelf

Import names in ELF binary

Where does the ELF format stores the names of imported functions? Is it always possible to enumerate all import names, like for PE executables?

For example, if a binary is using printf is it possible to tell it does, just by static analysis of the binary itself?

Solution

  • In ELF they're called undefined symbols. You can view the list of undefined symbols by:

    • nm -D <file>|grep -w U

    • objdump -T <file>|grep "\*UND\*"

    ELF files don't specify which symbols come from which libraries; it just adds a list of shared libraries to link to into the ELF binary, and lets the linker find the symbols in the libraries.