4

I would like to make IDA disassemble the .plt section of ELF files correctly, e.g. as objdump does: 

objdump -D -M intel asdf | grep "Disassembly of section .plt" -A80

objdump disassembly

I don't know why but IDA gives me this (Note the dw ? and dq ?): IDA disassembly

Even the IDA hexeditor does not show me the correct values at the corresponding addresses, but gives me ??s.

I tried selecting and deselecting the settings described in the IDA Online help (search for "PLT") but this didn't help...

0: Replace PIC form of 'Procedure Linkage Table' to non PIC form

1: Direct jumping from PLT (without GOT) regardless of its form

2: Convert PIC form of loading _GLOBAL_OFFSET_TABLE_[] of address

3: Obliterate auxiliary bytes in PLT & GOT for 'final autoanalysis'

4: Natural form of PIC GOT address loading in relocatable file

5: Unpatched form of PIC GOT references in relocatable file

How can I configure IDA so that I can access the instructions in the .plt section of an ELF file with IDAPython?

perror
  • 19,083
  • 29
  • 87
  • 150
langlauf.io
  • 1,560
  • 1
  • 19
  • 36

1 Answers1

2

For a 32bit (but not 64bit) x86 ELF binary, selecting the following options works:

enter image description here enter image description here enter image description here

UPDATE:

There is a bug in IDA 6.8 (and probably earlier versions): For 64bit x86 ELF binaries, I get the desired disassembly result only when additionally deselecting "Replace PIC form of ...".

This was the reason for my confusion and made me post my question.

Hex-rays sent me a patch which fixed it (and which will probably be part of future versions... )

langlauf.io
  • 1,560
  • 1
  • 19
  • 36
  • hello, how do you reach the settings "ELF patching (for PIC) and viewing mode" ? I can not find it – user3097712 Feb 28 '16 at 15:14
  • 1
    @user3097712 : In the "Load a new file" window, select "Loading options". See the checkmark in the left-hand screen shot. After that, the window you are asking for should appear automatically after hitting ok in the "Load a new file" window. Please tell me if it works. – langlauf.io Feb 28 '16 at 15:18
  • @user3097712 : if this works for you, you can of course upvote my answer :- ) – langlauf.io Feb 28 '16 at 18:15