Search code examples
staticreverseelfstrip

How to reverse a stripped ELF compiled -static?


I'm reversing an x64 ELF file which is compiled with -static,and it seems to be stripped. So,there is not any symbols when I run it in GDB. Can I recover the symbols?or do something to make it easier?

objdump -tT 6dd 
6dd:     file format elf64-x86-64
objdump: 6dd: not a dynamic object
SYMBOL TABLE:
no symbols
DYNAMIC SYMBOL TABLE:
no symbols
Entry point: 0x401058
    0x0000000000400190 - 0x00000000004001b0 is .note.ABI-tag
    0x00000000004001b0 - 0x00000000004001d4 is .note.gnu.build-id
    0x00000000004001d8 - 0x00000000004002f8 is .rela.plt
    0x00000000004002f8 - 0x0000000000400310 is .init
    0x0000000000400310 - 0x00000000004003d0 is .plt
    0x00000000004003d0 - 0x00000000004f1b78 is .text
    0x00000000004f1b80 - 0x00000000004f339c is __libc_freeres_fn
    0x00000000004f33a0 - 0x00000000004f3448 is __libc_thread_freeres_fn
    0x00000000004f3448 - 0x00000000004f3456 is .fini
    0x00000000004f3460 - 0x0000000000511424 is .rodata
    0x0000000000511428 - 0x0000000000511430 is __libc_atexit
    0x0000000000511430 - 0x0000000000511488 is __libc_subfreeres
    0x0000000000511488 - 0x0000000000511490 is __libc_thread_subfreeres
    0x0000000000511490 - 0x0000000000527174 is .eh_frame
    0x0000000000527174 - 0x00000000005272f6 is .gcc_except_table
    0x0000000000727ef0 - 0x0000000000727f10 is .tdata
    0x0000000000727f10 - 0x0000000000727f48 is .tbss
    0x0000000000727f10 - 0x0000000000727f18 is .init_array
    0x0000000000727f18 - 0x0000000000727f20 is .fini_array
    0x0000000000727f20 - 0x0000000000727f30 is .ctors
    0x0000000000727f30 - 0x0000000000727f40 is .dtors
    0x0000000000727f40 - 0x0000000000727f48 is .jcr
    0x0000000000727f50 - 0x0000000000727fd0 is .data.rel.ro
    0x0000000000727fd0 - 0x0000000000727fe0 is .got
    0x0000000000727fe8 - 0x0000000000728060 is .got.plt
    0x0000000000728060 - 0x0000000000729890 is .data
    0x00000000007298a0 - 0x000000000072cbe8 is .bss
    0x000000000072cbf0 - 0x000000000072cc38 is __libc_freeres_ptrs

Solution

  • Short answer: No.

    You need to get hold of the source and recompile to generate a debugging binary.