📚 OpenRCE is preserved as a read-only archive. Launched at RECon Montreal in 2005. Registration and posting are disabled.








Flag: Tornado! Hurricane!

 Forums >>  IDA Pro  >>  Find symbols from statically linked library

Topic created on: July 5, 2009 06:55 CDT by rajkosto .

I have an application that uses the Crypto++ library for all its crypto. I am trying to figure out the network protocol of this application, however this is very hard as Crypto++ is heavily templated and in addition, in this exe, its statically linked. Since Crypto++ is open source, is there any way i could compile it myself, and import the symbols into the exe so that i could see when Crypto++ functions are being called ? This is further complicated by the fact that i would have to compile the exact version they used to make the exe, however i have no idea what they used, but it seems to be an older version (4.x). Thanks in advance

  cod     July 5, 2009 14:31.58 CDT
the exact version, the same compiler.. but the biggest problem are the function address. Your application use crypto++ statically linked.. this mean that crypto++ was built as lib files, or using directly the source code..

If your application send data over network, start from those network functions following into stack the parameters..

  sepulo     July 7, 2009 05:13.16 CDT
I recommend using FLIRT. If there is not a FLIRT signature for the version you need, you yourself can create the signature. To find exact version of Crypto++ used with your application, you can compare strings used in a certain version against strings in your application. Searching for specific strings in binary is a good method to find exact version of statically linked libraries.

  pablo     July 13, 2009 19:35.13 CDT
The new version of BinDiff allows you to do exactly that and it should work even if it's not exactly the same version or if you used diff compile options.

  frankboldewin     July 14, 2009 16:54.36 CDT
i can confirm this. bindiff v3 is the perfect tool for this job!

Note: Registration is required to post to the forums.

There are 31,328 total registered users.


Recently Created Topics
[help] Unpacking VMP...
Mar/12
Reverse Engineering ...
Jul/06
let 'IDAPython' impo...
Sep/24
set 'IDAPython' as t...
Sep/24
GuessType return une...
Sep/20
About retrieving the...
Sep/07
How to find specific...
Aug/15
How to get data depe...
Jul/07
Identify RVA data in...
May/06
Question about memor...
Dec/12


Recent Forum Posts
Finding the procedur...
rolEYder
Question about debbu...
rolEYder
Identify RVA data in...
sohlow
let 'IDAPython' impo...
sohlow
How to find specific...
hackgreti
Problem with ollydbg
sh3dow
How can I write olly...
sh3dow
New LoadMAP plugin v...
mefisto...
Intel pin in loaded ...
djnemo
OOP_RE tool available?
Bl4ckm4n


Recent Blog Entries
halsten
Mar/14
Breaking IonCUBE VM

oleavr
Oct/24
Anatomy of a code tracer

hasherezade
Sep/24
IAT Patcher - new tool for ...

oleavr
Aug/27
CryptoShark: code tracer ba...

oleavr
Jun/25
Build a debugger in 5 minutes

More ...


Recent Blog Comments
nieo on:
Mar/22
IAT Patcher - new tool for ...

djnemo on:
Nov/17
Kernel debugger vs user mod...

acel on:
Nov/14
Kernel debugger vs user mod...

pedram on:
Dec/21
frida.github.io: scriptable...

capadleman on:
Jun/19
Using NtCreateThreadEx for ...

More ...


Imagery
SoySauce Blueprint
Jun 6, 2008

[+] expand

View Gallery (11) / Submit