Import names in ELF binary

5
votes

Where does the ELF format stores the names of imported functions? Is it always possible to enumerate all import names, like for PE executables?

For example, if a binary is using printf is it possible to tell it does, just by static analysis of the binary itself?

1
linuximportdllimportfile-formatelf

1 Answers

7
votes

In ELF they're called undefined symbols. You can view the list of undefined symbols by:

  • nm -D <file>|grep -w U

  • objdump -T <file>|grep "\*UND\*"

ELF files don't specify which symbols come from which libraries; it just adds a list of shared libraries to link to into the ELF binary, and lets the linker find the symbols in the libraries.