Linux ELF file: How to get the shared object belonging to an imported function -

given dynamically linked elf binary, example /bin/less.

inside binary, there call function provided shared library, example strcpy()

how can find out shared library/shared object strcp function obtained? in other words, want pairs func_name/shared_obj_name.so.

answering this post, michael slade wrote:

elf files don't specify symbols come libraries; adds list of shared libraries link elf binary, , lets linker find symbols in libraries.

yet there must way gather required info (using linker). executing binary , ltrace-ing not option in case. tried far:

i tried objdump -t /bin/less | grep strcpy gives me:

0000000000000000      df *und*  0000000000000000  glibc_2.2.5 strcpy 0000000000000000      df *und*  0000000000000000  glibc_2.3.4 __strcpy_chk 

this neither unambigious nor give me name of .so file.

running ldd /bin/less, returning:

linux-vdso.so.1 =>  (0x00007ffe8b7fa000) libtinfo.so.5 => /lib/x86_64-linux-gnu/libtinfo.so.5 (0x00007f92c23a5000) libc.so.6 => /lib/x86_64-linux-gnu/libc.so.6 (0x00007f92c1fe0000) /lib64/ld-linux-x86-64.so.2 (0x00007f92c25ec000)) 

lets me think "glibc_2.2.5" corresponds libc.so.6

how can programmatically find corresponding shared object (.so file) (imported) function?

how can find out shared library/shared object strcp function obtained?

in general can't: library can change @ runtime. example, if compile following source:

int strcpy(char *a, const char *src) { abort(); }  $ gcc -fpic -shared -o foo.so foo.c 

and run program so:

ld_preload=./foo.so /bin/less 

then library strcpy obtained foo.so. using ld_preload way called library interpositioning, , useful in kinds of circumstances.

there other ways inject different library process besides ld_preload.

if not using such mechanisms, , using glibc, can ask dynamic loader answer question you. here 1 way:

 ld_debug=bindings ldd -r /bin/less < /dev/null |& egrep '\wstrcpy\w'      26623: binding file /bin/bash [0] /lib/x86_64-linux-gnu/libc.so.6 [0]: normal symbol `strcpy' [glibc_2.2.5]      26633: binding file /lib/x86_64-linux-gnu/libtinfo.so.5 [0] /lib/x86_64-linux-gnu/libc.so.6 [0]: normal symbol `strcpy' [glibc_2.2.5]      26633: binding file /bin/less [0] /lib/x86_64-linux-gnu/libc.so.6 [0]: normal symbol `strcpy' [glibc_2.2.5] 

above can see ldd invokes bash , less separate processes, , both of them bind libc.so.6 particular symbol.