Faktisk er der ofte funktions navne i exe filerne.
Her er et dump af 'symbolerne' i et program jeg har lavet:
robert-debian:~/code/HttpBypassEpoll $ objdump -t HttpBypass
HttpBypass: file format elf32-i386
SYMBOL TABLE:
08048114 l d .interp 00000000 .interp
08048128 l d .note.ABI-tag 00000000 .note.ABI-tag
08048148 l d .hash 00000000 .hash
080482b8 l d .dynsym 00000000 .dynsym
08048608 l d .dynstr 00000000 .dynstr
080487d4 l d .gnu.version 00000000 .gnu.version
08048840 l d .gnu.version_r 00000000 .gnu.version_r
08048880 l d .rel.dyn 00000000 .rel.dyn
08048890 l d .rel.plt 00000000 .rel.plt
08048a18 l d .init 00000000 .init
08048a30 l d .plt 00000000 .plt
08048d50 l d .text 00000000 .text
0804c174 l d .fini 00000000 .fini
0804c190 l d .rodata 00000000 .rodata
0804cb10 l d .eh_frame 00000000 .eh_frame
0804d000 l d .ctors 00000000 .ctors
0804d008 l d .dtors 00000000 .dtors
0804d010 l d .jcr 00000000 .jcr
0804d014 l d .dynamic 00000000 .dynamic
0804d0dc l d .got 00000000 .got
0804d0e0 l d .got.plt 00000000 .got.plt
0804d1b0 l d .data 00000000 .data
0804d1c0 l d .bss 00000000 .bss
00000000 l d .comment 00000000 .comment
00000000 l d .debug_aranges 00000000 .debug_aranges
00000000 l d .debug_pubnames 00000000 .debug_pubnames
00000000 l d .debug_info 00000000 .debug_info
00000000 l d .debug_abbrev 00000000 .debug_abbrev
00000000 l d .debug_line 00000000 .debug_line
00000000 l d .debug_frame 00000000 .debug_frame
00000000 l d .debug_str 00000000 .debug_str
00000000 l d *ABS* 00000000 .shstrtab
00000000 l d *ABS* 00000000 .symtab
00000000 l d *ABS* 00000000 .strtab
00000000 l df *ABS* 00000000 abi-note.S
00000000 l df *ABS* 00000000 ../sysdeps/i386/elf/start.S
00000000 l df *ABS* 00000000 init.c
00000000 l df *ABS* 00000000 initfini.c
00000000 l df *ABS* 00000000 /build/buildd/glibc-2.3.5/build-tree/i386-libc/csu/crti.S
08048d74 l F .text 00000000 call_gmon_start
00000000 l df *ABS* 00000000 crtstuff.c
0804d000 l O .ctors 00000000 __CTOR_LIST__
0804d008 l O .dtors 00000000 __DTOR_LIST__
0804d010 l O .jcr 00000000 __JCR_LIST__
0804d1c4 l O .bss 00000001 completed.4463
0804d1b8 l O .data 00000000 p.4462
08048da0 l F .text 00000000 __do_global_dtors_aux
08048de0 l F .text 00000000 frame_dummy
00000000 l df *ABS* 00000000 crtstuff.c
0804d004 l O .ctors 00000000 __CTOR_END__
0804d00c l O .dtors 00000000 __DTOR_END__
0804cb10 l O .eh_frame 00000000 __FRAME_END__
0804d010 l O .jcr 00000000 __JCR_END__
0804c140 l F .text 00000000 __do_global_ctors_aux
00000000 l df *ABS* 00000000 initfini.c
00000000 l df *ABS* 00000000 /build/buildd/glibc-2.3.5/build-tree/i386-libc/csu/crtn.S
00000000 l df *ABS* 00000000 HttpBypass.c
0804d1d4 l O .bss 0000001e Buf.4483
0804d014 l O .dynamic 00000000 .hidden _DYNAMIC
0804d000 l *ABS* 00000000 .hidden __fini_array_end
0804d000 l *ABS* 00000000 .hidden __fini_array_start
0804d000 l *ABS* 00000000 .hidden __init_array_end
0804d0e0 l O .got.plt 00000000 .hidden _GLOBAL_OFFSET_TABLE_
0804d000 l *ABS* 00000000 .hidden __init_array_start
0804afc5 g F .text 000001aa DropConnection
08048e5e g F .text 0000006d TimeDiff
0804d200 g O .bss 00000004 RedirBacklog
0804d204 g O .bss 00000004 ActiveConnList
0804d1d0 g O .bss 00000004 PollSize
0804d1bc g O .data 00000004 MaxCon
0804d208 g O .bss 00000004 TmpFc
0804d20c g O .bss 00000004 RemoteDefaultPort
0804d210 g O .bss 00000004 AdminReadIndex
0804d214 g O .bss 00000010 RedirSoAddr
00000000 F *UND* 00000027 localtime@@GLIBC_2.0
00000000 F *UND* 00000071 close@@GLIBC_2.0
0804c190 g O .rodata 00000004 _fp_hw
00000000 F *UND* 000000af perror@@GLIBC_2.0
00000000 F *UND* 0000001a fprintf@@GLIBC_2.0
00000000 F *UND* 0000004e fork@@GLIBC_2.0
00000000 F *UND* 00000010 umask@@GLIBC_2.0
00000000 F *UND* 000000cb signal@@GLIBC_2.0
08048f18 g F .text 00000052 Die
0804a7e0 g F .text 000001e3 CheckAdminPort
08049abc g F .text 000002b4 CreateSockets
00000000 F *UND* 000000c2 vsnprintf@@GLIBC_2.0
00000000 F *UND* 0000008c strerror@@GLIBC_2.0
0804d224 g O .bss 00000004 RedirSockFdFd
0804d1b4 g O .data 00000000 .hidden __dso_handle
0804d228 g O .bss 00000010 RemoteSockAddr
0804c0e0 g F .text 00000058 __libc_csu_fini
0804a059 g F .text 000006a7 ProcessAdminRequest
0804d238 g O .bss 00000004 AdminSockFdFd
00000000 F *UND* 00000042 epoll_wait@@GLIBC_2.3.2
0804d23c g O .bss 00000004 PollFd
0804d240 g O .bss 00000004 AdminInAddr
00000000 F *UND* 00000035 __errno_location@@GLIBC_2.0
0804d244 g O .bss 00000004 RedirSockFd
00000000 F *UND* 00000078 accept@@GLIBC_2.0
0804b94e g F .text 00000056 PrintFdSet
00000000 F *UND* 00000039 shutdown@@GLIBC_2.0
08048a18 g F .init 00000000 _init
00000000 F *UND* 00000039 listen@@GLIBC_2.0
08049fb1 g F .text 000000a8 CheckNewConnections
00000000 F *UND* 000001b7 malloc@@GLIBC_2.0
00000000 F *UND* 0000002e setsid@@GLIBC_2.0
00000000 F *UND* 00000044 strftime@@GLIBC_2.0
0804d248 g O .bss 00000004 RedirInAddr
0804acb7 g F .text 0000030e ExecuteIO
0804ab5c g F .text 0000015b ScanForHeader
0804d24c g O .bss 00000004 Now
0804d1c0 g O .bss 00000004 stderr@@GLIBC_2.0
0804d250 g O .bss 00000010 AdminSoAddr
00000000 F *UND* 00000039 setsockopt@@GLIBC_2.0
0804b9a4 g F .text 000002d6 RunServer
0804d260 g O .bss 00000008 tz
00000000 F *UND* 00000010 time@@GLIBC_2.0
0804d268 g O .bss 00000004 RemoteInAddr
08048d50 g F .text 00000000 _start
0804d280 g O .bss 00000800 AdminBuffer
0804da80 g O .bss 00000004 TimeoutCnt
00000000 F *UND* 00000175 fgets@@GLIBC_2.0
0804da84 g O .bss 00000004 LoopTime_us
00000000 F *UND* 00000036 epoll_create@@GLIBC_2.3.2
00000000 F *UND* 00000036 chdir@@GLIBC_2.0
00000000 F *UND* 00000128 fputs@@GLIBC_2.0
0804a700 g F .text 000000e0 TerminateAdminSession
00000000 F *UND* 0000016e strstr@@GLIBC_2.0
0804da88 g O .bss 00000004 ClientCntPeak
0804da8c g O .bss 00000004 AdminState
08048ecb g F .text 0000004d InAddrToString
0804c070 g F .text 00000063 __libc_csu_init
00000000 F *UND* 00000027 inet_addr@@GLIBC_2.0
0804da90 g O .bss 00000004 ClientCnt
0804d1c0 g *ABS* 00000000 __bss_start
0804da94 g O .bss 00000004 AdminFd
0804d1c8 g O .bss 00000004 TimeOut
0804bc7a g F .text 000003ea main
00000000 F *UND* 000001a4 strcasestr@@GLIBC_2.1
08048e08 g F .text 0000002f FreeFds
00000000 F *UND* 000000ce __libc_start_main@@GLIBC_2.0
0804da98 g O .bss 00000004 AdminFdFd
0804d1b0 w .data 00000000 data_start
0804907d g F .text 00000a3f ReadConfigFile
00000000 F *UND* 0000002f printf@@GLIBC_2.0
00000000 F *UND* 00000039 bind@@GLIBC_2.0
0804c174 g F .fini 00000000 _fini
00000000 F *UND* 00000071 fcntl@@GLIBC_2.0
00000000 F *UND* 00000202 fclose@@GLIBC_2.1
0804b16f g F .text 000007df CheckIOStatus
0804a9c3 g F .text 00000199 CheckAdminSocket
08048f6a g F .text 00000113 Daemonize
00000000 F *UND* 0000002e snprintf@@GLIBC_2.0
0804daa0 g O .bss 00040000 RemoteHostTable
0804d1cc g O .bss 00000004 FreeFd
00000000 F *UND* 0000017a gethostbyname@@GLIBC_2.0
00000000 F *UND* 00000042 epoll_ctl@@GLIBC_2.3.2
0808daa0 g O .bss 00000004 ConnectCount
00000000 F *UND* 000000dc exit@@GLIBC_2.0
0808daa4 g O .bss 00000004 RemoteSaddrLen
08048e37 g F .text 00000027 ListLength
00000000 F *UND* 0000002a sscanf@@GLIBC_2.0
0804d1c0 g *ABS* 00000000 _edata
0808daa8 g O .bss 00000004 AdminBytesIn
00000000 F *UND* 000000b4 free@@GLIBC_2.0
0808dbc4 g *ABS* 00000000 _end
00000000 F *UND* 00000078 send@@GLIBC_2.0
00000000 F *UND* 0000000e htons@@GLIBC_2.0
0808daac g O .bss 00000004 FreeConnList
0808dab0 g O .bss 00000004 RejectCnt
00000000 F *UND* 00000048 memset@@GLIBC_2.0
00000000 F *UND* 0000008a strncasecmp@@GLIBC_2.0
00000000 F *UND* 00000078 connect@@GLIBC_2.0
0808dab4 g O .bss 00000004 AdminPort
00000000 F *UND* 00000024 fopen@@GLIBC_2.1
0808dab8 g O .bss 00000004 RedirLocalPort
0804c194 g O .rodata 00000004 _IO_stdin_used
0808dabc g O .bss 00000004 ClientCntPeakTime
0808dac0 g O .bss 00000100 ConfigFileName
00000000 F *UND* 00000078 recv@@GLIBC_2.0
00000000 F *UND* 0000002a sprintf@@GLIBC_2.0
0804d1b0 g .data 00000000 __data_start
00000000 F *UND* 00000039 socket@@GLIBC_2.0
00000000 w *UND* 00000000 _Jv_RegisterClasses
0808dbc0 g O .bss 00000004 AdminSockFd
00000000 F *UND* 0000007c read@@GLIBC_2.0
00000000 F *UND* 0000004f geteuid@@GLIBC_2.0
08049d70 g F .text 00000241 AddNewConnection
00000000 w *UND* 00000000 __gmon_start__
..men de symboler vil man nok ofte fjerne i releasede programmer:
robert-debian:~/code/HttpBypassEpoll $ strip HttpBypass
robert-debian:~/code/HttpBypassEpoll $ objdump -t HttpBypass
HttpBypass: file format elf32-i386
SYMBOL TABLE:
no symbols
:) robert-debian:~/code/HttpBypassEpoll $
Decompilere
kan faktisk gøre reverse engineering en del lettere.
Prøv Boomerang:
http://boomerang.sourceforge.net/nu er det jo ikke java jeg bruger java er kun til hjemme brug og det er kedeligt.
mhmm..