11.3 Imports

Rabin is able to get all the imported objects, as well as their offset at the PLT, this information is quite useful, for example, to recognize wich function is called by a call instruction.

$ rabin -i /bin/ls | head
[Imports]
address=0x08049484 offset=0x00001484 bind=GLOBAL type=FUNC name=abort
address=0x08049494 offset=0x00001494 bind=GLOBAL type=FUNC name=__errno_location
address=0x080494a4 offset=0x000014a4 bind=GLOBAL type=FUNC name=sigemptyset
address=0x080494b4 offset=0x000014b4 bind=GLOBAL type=FUNC name=sprintf
address=0x080494c4 offset=0x000014c4 bind=GLOBAL type=FUNC name=localeconv
address=0x080494d4 offset=0x000014d4 bind=GLOBAL type=FUNC name=dirfd
address=0x080494e4 offset=0x000014e4 bind=GLOBAL type=FUNC name=__cxa_atexit
address=0x080494f4 offset=0x000014f4 bind=GLOBAL type=FUNC name=strcoll
address=0x08049504 offset=0x00001504 bind=GLOBAL type=FUNC name=fputs_unlocked
(...)

The flag -v will output human readable output.

$ rabin -iv /bin/ls
[Imports]
Memory address  File offset     Name
0x08049484      0x00001484      abort
0x08049494      0x00001494      __errno_location
0x080494a4      0x000014a4      sigemptyset
0x080494b4      0x000014b4      sprintf
0x080494c4      0x000014c4      localeconv
0x080494d4      0x000014d4      dirfd
0x080494e4      0x000014e4      __cxa_atexit
0x080494f4      0x000014f4      strcoll
0x08049504      0x00001504      fputs_unlocked
(...)

Combined with -vv, we get two new columns, bind (LOCAL, GLOBAL, etc.) and type (OBJECT, FUNC, SECTION, FILE, etc.)

$ rabin -ivv /bin/ls
[Imports]
Memory address  File offset     Bind    Type    Name
0x08049484      0x00001484      GLOBAL  FUNC    abort
0x08049494      0x00001494      GLOBAL  FUNC    __errno_location
0x080494a4      0x000014a4      GLOBAL  FUNC    sigemptyset
0x080494b4      0x000014b4      GLOBAL  FUNC    sprintf
0x080494c4      0x000014c4      GLOBAL  FUNC    localeconv
0x080494d4      0x000014d4      GLOBAL  FUNC    dirfd
0x080494e4      0x000014e4      GLOBAL  FUNC    __cxa_atexit
0x080494f4      0x000014f4      GLOBAL  FUNC    strcoll
0x08049504      0x00001504      GLOBAL  FUNC    fputs_unlocked
(...)

Again, with -r we can automatically flag them in radare.

$ rabin -ir /bin/ls