Cyberlium

Reverse › Module 4 › Lesson 3

BeginnerModule 4Lesson 3/5

Sections and Symbols

Section names and symbol tables accelerate RE — use on unstripped $RE_LAB toys, respect licenses on stripped commercial binaries.

15 min+40 XP3 quiz
Module progress3 of 5

Visual · re_sections_symbols

Sections/symbols literacy. $RE_LAB only. Original Cyberlium.

Opening

Symbols name functions — unstripped toy binaries teach; stripped crackmes challenge.

Symbol tables map addresses to names — main, check_password, strcmp PLT. Section names group.text,.rodata strings,.data globals. readelf -s and nm list symbols on Linux; dumpbin /exports on Windows. Stripped binaries hide names — analysis relies on strings and CFG on $RE_LAB. Cyberlium teaches section/symbol literacy for faster navigation. You will NOT leak proprietary symbols from commercial software. Next: Format Lab.

1. Sections as map

.rodata holds format strings and constant passwords in toy binaries — strings cross-ref finds them.bss holds uninitialized globals;.data holds initialized.

Compare section sizes between debug and release builds of YOUR toy on $RE_LAB — strip flag removes symtab.

Command guide

Try these commands — Sections as map

═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)

readelf -S/-s — https://man7.org/linux/man-pages/man1/readelf.1.html (sections and symbol table) nm(1) — https://man7.org/linux/man-pages/man1/nm.1.html (symbol visibility) IDA symbol view — https://docs.hex-rays.com/ (GUI symbol literacy — use on YOUR toys only)

═══ INSTALL ═══

Linux (Debian/Ubuntu):

Command — copy this

sudo apt install binutils

macOS:

Command — copy this

brew install binutils

Built-in or brew install binutils

Windows: Use WSL binutils

═══ LINUX / macOS ═══

Optional command

sudo apt install binutils  # readelf nm objdump

Command — copy this

export LAB_RE=${LAB_RE:-$HOME/cyberlium-lab/t23-re}
readelf -S "$LAB_RE/bin/check" | head -20
readelf -s "$LAB_RE/bin/check" | grep -E ' main| add| puts' | head -8
nm "$LAB_RE/bin/check" | grep -E ' main| add| puts'

Primary tools to practice this lesson: readelf, nm. Reference sites: readelf -S/-s (https://man7.org/linux/man-pages/man1/readelf.1.html); nm(1) (https://man7.org/linux/man-pages/man1/nm.1.html); IDA symbol view (https://docs.hex-rays.com/). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.

2. Symbols and imports

Dynamic symbols show imported libc functions — strcmp hints password compare. Export tables matter for DLL crackmes on $RE_LAB Windows.

Import Address Table (IAT) resolves at load — static RE lists expected API capabilities before dynamic trace.

3. Symbol literacy ethics

Forbidden: publishing symbol dumps from commercial products, using leaked PDBs to bypass license on paid software, or scraping unauthorized firmware symbol tables.

Ship: symbol shortlist — five names or imports from YOUR unstripped toy + one string from.rodata. Next: Format Lab.

4. What you ship: sections/symbols shortlist for $RE_LAB

Five symbols/imports + one.rodata string from YOUR toy. $RE_LAB named. NEVER commercial symbol leaks. chmod 600.

5. What you record before the next lesson

Date. Sections/symbols shortlist. $RE_LAB named. File t23-m04-l03-sections-symbols.txt chmod 600.

6. Wrong vs right: commercial piracy vs crackmes/CTF toys

Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.

  • Wrong

    Publish commercial PDB dump. Skip import table on PE crackme.

  • Right

    Write sections/symbols shortlist for $RE_LAB toy. Next: Format Lab.

Mission: list symbols on YOUR toy

1) Run nm or readelf -s on unstripped toy. 2) List five symbols/imports. 3) Pull one string from.rodata. 4) chmod 600.

Stuck? Ask Cyberlium AI Mentor

strcmp in imports often marks password gate.

Knowledge Check

1

APPLY: Sections/symbols literacy means:

Multiple choice

Knowledge Check

2

APPLY: True or False: Stripped binaries omit most symbol names.

True or False

Knowledge Check

3

APPLY:rodata typically contains:

Multiple choice

← Previous

Answer all 3 knowledge checks to continue. (0/3 answered)