Search code examples
ctcpshared-librariesreverse-engineeringida

How to determine unknown socket options?


While reverse engineering a so library designed for android, I saw following code lines for a tcp connection.

int v28[2];
v28[1] = 0;
v28[0] = 10;

setsockopt(socket_ref, 1, 21, v28, 8);
setsockopt(socket_ref, 1, 20, v28, 8);

Second parameter defines level as SOL_SOCKET. But option values 20 and 21 is unknown. Can someone explain what is going on?

(I read many documentations from different websites with hoping to find those options. But I didn't find any documentation that explains options 20 and 21.)


Solution

  • You likely won't find documentation on what those specific codes map to, as that's an implementation detail of your environment. What you can do is search the system header files where SOL_SOCKET is defined and see if you can find the matching options.

    For example, on my CentOS 7 machine, I searched for the defintion of the SOL_SOCKET level:

    [dbush@db-centos7 ~]$ grep -r SOL_SOCKET /usr/include
    /usr/include/asm-generic/socket.h:#define SOL_SOCKET    1
    /usr/include/linux/atm.h: * SOL_SOCKET is 0xFFFF, so that's a bit of a problem
    /usr/include/linux/dn.h: * DNPROTO_NSP can't be the same as SOL_SOCKET, 
    

    Where I found it in /usr/include/asm-generic/socket.h. Looking at this file, I found this:

    /* For setsockopt(2) */
    #define SOL_SOCKET  1
    
    #define SO_DEBUG    1
    #define SO_REUSEADDR    2
    #define SO_TYPE     3
    #define SO_ERROR    4
    #define SO_DONTROUTE    5
    #define SO_BROADCAST    6
    #define SO_SNDBUF   7
    #define SO_RCVBUF   8
    #define SO_SNDBUFFORCE  32
    #define SO_RCVBUFFORCE  33
    #define SO_KEEPALIVE    9
    #define SO_OOBINLINE    10
    #define SO_NO_CHECK 11
    #define SO_PRIORITY 12
    #define SO_LINGER   13
    #define SO_BSDCOMPAT    14
    #define SO_REUSEPORT    15
    #ifndef SO_PASSCRED /* powerpc only differs in these */
    #define SO_PASSCRED 16
    #define SO_PEERCRED 17
    #define SO_RCVLOWAT 18
    #define SO_SNDLOWAT 19
    #define SO_RCVTIMEO 20
    #define SO_SNDTIMEO 21
    #endif
    

    So, at least on my system, options 20 and 21 are SO_RCVTIMEO and SO_SNDTIMEO respectively. These may differ on your system, so search the header files to be sure.