Reverse › Module 4 › Lesson 3
Sections and Symbols
Section names and symbol tables accelerate RE — use on unstripped $RE_LAB toys, respect licenses on stripped commercial binaries.
Visual · re_sections_symbols
Sections/symbols literacy. $RE_LAB only. Original Cyberlium.
Opening
Symbols name functions — unstripped toy binaries teach; stripped crackmes challenge.
Symbol tables map addresses to names — main, check_password, strcmp PLT. Section names group.text,.rodata strings,.data globals. readelf -s and nm list symbols on Linux; dumpbin /exports on Windows. Stripped binaries hide names — analysis relies on strings and CFG on $RE_LAB. Cyberlium teaches section/symbol literacy for faster navigation. You will NOT leak proprietary symbols from commercial software. Next: Format Lab.
1. Sections as map
.rodata holds format strings and constant passwords in toy binaries — strings cross-ref finds them.bss holds uninitialized globals;.data holds initialized.
Compare section sizes between debug and release builds of YOUR toy on $RE_LAB — strip flag removes symtab.
Command guide
Try these commands — Sections as map
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
readelf -S/-s — https://man7.org/linux/man-pages/man1/readelf.1.html (sections and symbol table) nm(1) — https://man7.org/linux/man-pages/man1/nm.1.html (symbol visibility) IDA symbol view — https://docs.hex-rays.com/ (GUI symbol literacy — use on YOUR toys only)
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install binutils
macOS:
Command — copy this
brew install binutils
Built-in or brew install binutils
Windows: Use WSL binutils
═══ LINUX / macOS ═══
Optional command
sudo apt install binutils # readelf nm objdump
Command — copy this
export LAB_RE=${LAB_RE:-$HOME/cyberlium-lab/t23-re}
readelf -S "$LAB_RE/bin/check" | head -20
readelf -s "$LAB_RE/bin/check" | grep -E ' main| add| puts' | head -8
nm "$LAB_RE/bin/check" | grep -E ' main| add| puts'Primary tools to practice this lesson: readelf, nm. Reference sites: readelf -S/-s (https://man7.org/linux/man-pages/man1/readelf.1.html); nm(1) (https://man7.org/linux/man-pages/man1/nm.1.html); IDA symbol view (https://docs.hex-rays.com/). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Symbols and imports
Dynamic symbols show imported libc functions — strcmp hints password compare. Export tables matter for DLL crackmes on $RE_LAB Windows.
Import Address Table (IAT) resolves at load — static RE lists expected API capabilities before dynamic trace.
3. Symbol literacy ethics
Forbidden: publishing symbol dumps from commercial products, using leaked PDBs to bypass license on paid software, or scraping unauthorized firmware symbol tables.
Ship: symbol shortlist — five names or imports from YOUR unstripped toy + one string from.rodata. Next: Format Lab.
4. What you ship: sections/symbols shortlist for $RE_LAB
Five symbols/imports + one.rodata string from YOUR toy. $RE_LAB named. NEVER commercial symbol leaks. chmod 600.
5. What you record before the next lesson
Date. Sections/symbols shortlist. $RE_LAB named. File t23-m04-l03-sections-symbols.txt chmod 600.
6. Wrong vs right: commercial piracy vs crackmes/CTF toys
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Publish commercial PDB dump. Skip import table on PE crackme.
Right
Write sections/symbols shortlist for $RE_LAB toy. Next: Format Lab.
Mission: list symbols on YOUR toy
1) Run nm or readelf -s on unstripped toy. 2) List five symbols/imports. 3) Pull one string from.rodata. 4) chmod 600.
Stuck? Ask Cyberlium AI Mentor
strcmp in imports often marks password gate.
Knowledge Check
APPLY: Sections/symbols literacy means:
Multiple choice
Knowledge Check
APPLY: True or False: Stripped binaries omit most symbol names.
True or False
Knowledge Check
APPLY:rodata typically contains:
Multiple choice