Background: We have a third-party vendor software for our Linux distribution that we are currently testing on lubuntu. We have the installation files and an install.sh shell script that installs the necessary binaries for the software in the correct directories.

We would like to determine which static libraries are being used internally by this software (so we can tell if they are outdated and introduce vulnerabilities in our environment).

What we have done so far: we looked at ldd but it only lists shared or dynamic libraries. Same with objdump. We used strings to look at the strings hidden in some of these binaries to see signs of library version numbers and such. But this is a very time-consuming and inefficient process for large binaries.

Question: How can we discover and list static libraries used in a software under the Linux environment?

  • If the vendor removed all linking information from the resulting binary, then you can't. However, gcc often leaves some information. First step is to look at the available sections in the binary with objdump -afh /your/file, please edit question with output. – dirkt Jul 8 '18 at 5:18
  • Given what you have tried already, You need to Reverse Engineer whole thing. Also you can get some or any useful info with readelf. Best of Luck ! – C0deDaedalus Jul 8 '18 at 9:41

How can we discover and list static libraries used in a Linux program?

ldd <exe filename> shows dynamically linked libraries

nm <exe filename> shows the symbols in the file.

To see which symbols come from static libraries requires running nm against those libraries to get a list of the symbols (functions, etc.) in them, then comparing them to what your list of symbols from nm <exe filename>.

You compare lists with the comm command. See man comm for details.

This was taken from this forum here.

Source Get list of static libraries used in an executable, answer by DrAl

  • nm says "no symbols" for all the binaries that we have tried it on for the software so far. – learnerX Jul 6 '18 at 21:27
  • Also, as a comment on that answer says: "If its an unknown binary, we don't know what libraries are present. So "running nm against those libraries " sounds self defeating." – learnerX Jul 6 '18 at 21:30
  • Why don't you just ask the vendor? – DavidPostill Jul 6 '18 at 21:43

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.