Skip to content

A plugin for Hex-Ray's IDA Pro and radare2 to export the symbols recognized to the ELF symbol table

License

Notifications You must be signed in to change notification settings

danigargu/syms2elf

Folders and files

NameName
Last commit message
Last commit date

Latest commit

 

History

12 Commits
 
 
 
 
 
 

Repository files navigation

syms2elf

The plugin export the symbols (for the moment only functions) recognized by IDA Pro and radare2 to the ELF symbol table. This allows us to use the power of IDA/r2 in recognizing functions (analysis, FLIRT signatures, manual creation, renaming, etc), but not be limited to the exclusive use of this tools.

Supports 32 and 64-bits file format.

INSTALLATION

  • IDA Pro: Simply, copy syms2elf.py to the IDA's plugins folder.
  • radare2: You can install via r2pm: r2pm -i syms2elf

EXAMPLE

Based on a full-stripped ELF:

$ file test1_x86_stripped 
test1_x86_stripped: ELF 32-bit LSB executable, Intel 80386, version 1 (SYSV), dynamically linked (uses shared libs), for GNU/Linux 2.6.32, stripped

Rename some functions in IDA or r2, run syms2elf and select the output file.

IDA output log

r2_syms2elf

After that:

$ file test1_x86_unstripped 
test1_x86_unstripped: ELF 32-bit LSB executable, Intel 80386, version 1 (SYSV), dynamically linked (uses shared libs), for GNU/Linux 2.6.32, not stripped

Now, you can open it with others tools and analyzing in a more comfortable way.

AUTHORS

  • Daniel García (@danigargu)
  • Jesús Olmos (@sha0coder)

CONTACT

Any comment or request will be highly appreciated :-)

About

A plugin for Hex-Ray's IDA Pro and radare2 to export the symbols recognized to the ELF symbol table

Resources

License

Stars

Watchers

Forks

Releases

No releases published

Packages

No packages published

Languages