10

The situation is the following:

I'm reversing an application, In which I found a lot of functions that belongs to the OpenSSL library. Since I have the source code for this module, I was wondering if it's possible to somehow "extract" the variable names, structures, function names from the source code, and sync/map it to IDA?

Dominik Antal
  • 2,038
  • 22
  • 39
  • 1
    Most likely not. You'd probably have to build the same version of OpenSSL, under the same version of the same compiler with the same settings to get a binary that's close enough to what you're RE'ing, in order to perform any simple matching. – Jonathon Reinhart Dec 12 '13 at 05:52
  • 1
    Or, you can just compile this source code with all the symbols and analyze it, diff it with what you have. I'm pretty sure even if the compiled binary will not be exactly the same, but it will be very close. To be even more close, you can try to compile with the same compiler the original binary was compiled. – PhoeniX Dec 12 '13 at 08:07
  • 1
    Even if you compile with different settings, the order of functions will be the same. So if you can identify one function, then the following functions should be the same as the ones following before/after it in the source module. – Devolus Dec 18 '13 at 08:26
  • @Devolus Okey, but how can I automate this process? I mean I compiled the said module, I recognize the functions, but I can't manually name all the variables and function names. – Dominik Antal Dec 18 '13 at 09:12
  • 1
    I don't think you can automatize this, as there is no sure mapping between variables and the resulting code, especially if compiled with optimizer. I don't see why this should matter though. For reversing, it would be enough to know the signatures of the library, and if you want to make a compilable code, then you can use the source anyway, unless the code relies on some specific behaviour of that particular version, which is doubtfull imo. – Devolus Dec 18 '13 at 09:22
  • @Devolus My intent is not to recreate the app, I'ld like to be able to see the labels and variable names, so I can reach a better overall understanding of the debugged application. It would also help me identify further functions, based on their calls to this known module. – Dominik Antal Dec 18 '13 at 09:26

1 Answers1

8
  1. Build the module with debug symbols
  2. Load the module you built into IDA Pro and import the debug symbols
  3. Use BinDiff to port function names, etc. from the IDB of the module you built to the IDB of your target module
Jason Geffner
  • 20,681
  • 1
  • 36
  • 75