-
-
Notifications
You must be signed in to change notification settings - Fork 3.1k
Description
Work environment
| Questions | Answers |
|---|---|
| OS/arch/bits (mandatory) | Arch x86_64 |
| File format of the file you reverse (mandatory) | ELF |
| Architecture/bits of the file (mandatory) | arm 32 |
| r2 -v full output, not truncated (mandatory) | radare2 4.6.0-git 25551 @ linux-x86-64 git.4.4.0-580-g7066f58d8 |
| commit: 7066f58 build: 2020-08-25__09:23:38 |
Expected behavior
When a function exported by a shared object file is called from within that shared object file, the function name for the stub in the plt section should be named properly.
Example: in libcurl, the function Curl_getaddrinfo_ex is called from the function Curl_ipv4_resolve_r. That function call should appear as sym.imp.Curl_getaddrinfo_ex.
Actual behavior
Instead of sym.imp.Curl_getaddrinfo_ex, the function is flagged fcn.000074fc. This makes analysis a bit painful.
The address that the plt stub points to is correctly identified as reloc.Curl_getaddrinfo_ex, so the relocation is being correctly ID'd (I've also double-checked with Ghidra).
Steps to reproduce the behavior
Asciinema: https://asciinema.org/a/o4UkBFPskH5rhJZ8lwjuNTKJC
Representative file here: libcurl.zip
Here is a screenshot from ghidra showing the same address (though, interestingly, it's mapped at 0x174fc instead of 0x74fc):
