-
-
Notifications
You must be signed in to change notification settings - Fork 3.1k
Closed
Description
Environment
> date
Wed Jan 8 04:47:36 PM UTC 2025
> r2 -v
radare2 5.9.9 579 @ linux-x86-32
birth: git.5.9.9 2025-01-08__15:32:28
commit: d02b7d5eca489ade222ed67cc0c5679f76e8a56e
options: gpl -O1 cs:5 cl:1 meson
> uname -ms
Linux x86_64
Description
radare2 could infer correct names for thunk functions.
See the attached binary
$ r2 ./binary
> aaa
> s main
> pdf
// redacted ...
│ 0x08048855 50 push eax
│ 0x08048856 e88dfdffff call fcn.080485e8
│ 0x0804885b 83c410 add esp, 0x10
[0x0804882e]> s 0x80485e8
[0x080485e8]> pd 3
; CALL XREFS from main @ 0x8048856(x), 0x804886a(x), 0x804887e(x)
0x080485e8 ff25f09f0408 jmp dword [reloc.setvbuf] ; 0x8049ff0
0x080485ee 6690 nop
; CALL XREF from sym.leave @ 0x8048796(x)
0x080485f0 ff25f49f0408 jmp dword [reloc.memset] ; 0x8049ff4
But with gdb or objdump, it is displayed as:
8048856: call 80485e8 <setvbuf@plt>
Test
Metadata
Metadata
Assignees
Labels
No labels