Search code examples
shared-librariesreverse-engineeringsymbols

Symbols of function in a library


I know with these commands:

readelf -sW alloc.o | awk '$4 == "FUNC"'

nm alloc.o | awk '$2=="T" || $2=="t"'

I can get the names of functions which are used in a library.

BUT, how can I differentiate the functions which are USED by the library, and the functions which are DEFINED by the library?

Is there another way to get functions DEFINED by a library?

Thank you very much!


Solution

  • I know with these commands: ... I can get the names of functions which are used in a library.

    No, you can't. What the commands give you is a list of functions defined in an object file (or a library).

    Is there another way to get functions DEFINED by a library

    Why do you need another way?

    how can I differentiate the functions which are USED by the library, and the functions which are DEFINED by the library

    That depends on what you mean by "USED by the library". A typical library will use some of its own functions, and some functions from outside. For example, a library containing foo.o and bar.o, where foo() calls bar(), and bar() calls outside baz(), would look like this:

     readelf -Ws libfoobar.a | egrep 'foo|bar|baz' | grep -v ' ABS'
    File: libfoobar.a(foo.o)
         8: 0000000000000000    16 FUNC    GLOBAL DEFAULT    1 foo
         9: 0000000000000000     0 NOTYPE  GLOBAL DEFAULT  UND bar
    File: libfoobar.a(bar.o)
         8: 0000000000000000    16 FUNC    GLOBAL DEFAULT    1 bar
         9: 0000000000000000     0 NOTYPE  GLOBAL DEFAULT  UND baz
    

    Here you can see that foo.o defines foo, and uses bar; that bar.o defines bar and uses baz (which is not defined in this library).

    What you can't see is whether foo is used by the library (e.g. whether foo is recursive or not).