6 ms·
Libtree: Ldd as a tree saying why a library is found or not
- juliangmp 2y agoUser this tool before for double checking our foss compliance, its pretty neat
- mgaunard 2y agothis is so useful; I usually read sections with readelf to figure out what the real requirements are
- monocasa 2y agoDoes this copy that unexpected behavior where ldd will actually execute some libraries it's interrogating? https://catonmat.net/ldd-arbitrary-code-execution https://catonmat.net/ldd-arbitrary-code-execution
- jcul 2y agoFrom a quick scan of the code, on mobile, it doesn't look like it does. This seems to actually manually parse the ELF file and recursively parse any dependencies. Pretty cool.
- mid-kid 2y agoRecent (like 5+ years) versions of "ldd" will not invoke the target binary either. See: https://manpages.debian.org/unstable/manpages/ldd.1.en.html#Security https://manpages.debian.org/unstable/manpages/ldd.1.en.html#...
- nextaccountic 2y agoDoes this mean that ldd is secure by default now?
- zem 2y agoI wrote something vaguely similar for python and we could never get around that issue https://github.com/google/importlab/issues/69 https://github.com/google/importlab/issues/69
- blueflow 2y agoOr use objdump, which prints the data as it is encoded in the ELF file. Including the list of libraries the vdso will search for.
- jononor 2y agoHaving to recursively and iteratively hunt missing dependencies with ldd can be pretty tedious. So this seems like a good improvement. Will try it next time I get an obscure not found
- userbinator 2y agoBasically the Linux CLI version of depends.exe.
- eps 2y agoYep, my thoughts exactly. [1] https://www.dependencywalker.com/ https://www.dependencywalker.com/
- PreInternet01 2y agoNote that that particular tool doesn't work very well for modern Windows versions anymore. Use https://github.com/lucasg/Dependencies https://github.com/lucasg/Dependencies instead (even though that isn't exactly up-to-date either...) If you have Visual Studio installed (and have selected the 'x64/x86 build tools (latest)' in the installer), `dumpbin /dependents` from a VS Developer Command Prompt remains the most reliable option.
- clumsysmurf 2y agoAnyone know of something similar for MacOS?
- jevinskie 2y agohttps://github.com/ReverseApple/dgraph https://github.com/ReverseApple/dgraph but IIRC it still has some @rpath and its Apple extended family counterpart issues. PRs welcome!
- khoobid_shoma 2y ago[flagged]
- heinrich5991 2y agoC++, Nim, Rust, Zig would probably work as well.
- speed_spread 2y ago[flagged]
- pornel 2y agoUsually people compile a "hello world" exe, and implicitly extrapolate that size to all programs of all sizes. ...which is then followed by arguments about how libc's own size should be compared to other libs that need to be linked statically and do a different amount of work.
- NekkoDroid 2y agoFun little fact about gcc's lib sizes (no libc): https://gitlab.archlinux.org/archlinux/packaging/packages/gcc/-/issues/5#note_147918 https://gitlab.archlinux.org/archlinux/packaging/packages/gc...
- pjc50 2y agoI wonder if this implementation is exploitable by malformed libraries.
- semmulder 2y agoIs LD_DEBUG=libs not enough?
- dooglius 2y agoWhat does "why a library is found or not" mean? It is either in the LD_LIBRARY_PATH or it isn't? The screenshot doesn't make it clear to me what this refers to.
- stabbles 2y agoSee `man ld.so` for the search behavior. Note that there are inconsistencies between glibc and musl when it comes to rpath and runpath.
- georgyo 2y agoI don't know what it means in the context of this tool, but library searching is much more complicated than a single environment variable. There is the system search path, runpath, rpath, and LD_LIBRARY_PATH as just a few different distinct methods library searched on directories. Libraries are also usually linked just by the short name, IE foo.so, but they can also be dynamically linked to the full path of the library. Side note, as a general rule if you can avoid setting the LD_LIBRARY_PATH you'll be much off. It's not always possible, but setting puts it at the top of the search for all executions. Even if something dynamically links the full path to a library, LD_LIBRARY_PATH will take precedence. It completely flattens the search.
- wpollock 2y agoOn top of that, libraries can be linked by their SONAME and not the file name. (This is rarely done however.)
- cylemons 2y agoI thought dynamic linking always uses the soname
- bregma 2y agoStatic linking uses the DT_SONAME of a linked library to create an entry in the DT_NEEDED table. The name in the DT_NEEDED table is used by the dynamic loader to search for a matching filename to load in. So in a very indirect sense the dynamic loader always uses the SONAME that was supplied at build time, but it also uses a search algorithm to find that filename at load time.
- cozzyd 2y agoI love this joke: curl -Lfs https://raw.githubusercontent.com/haampie/libtree/master/libtree.c https://raw.githubusercontent.com/haampie/libtree/master/lib... | ${CC:-cc} -o libtree -x c - -std=c99 -D_FILE_OFFSET_BITS=64
- stabbles 2y agoThe original joke was to define an alias alias libtree='curl -LfSs https://raw.githubusercontent.com/haampie/libtree/master/libtree.c | ${CC:-cc} -o /tmp/libtree -x c - -std=c99 -D_FILE_OFFSET_BITS=64; /tmp/libtree' so any time you invoke `libtree` it downloads the latest version, compiles it, and runs it. With a stable internet connection, it is still faster than pax-util's lddtree, which is written in Python. C is an excellent scripting language.
- wakawaka28 2y agoThe joke that kills lol
- slimsag 2y agoThe first suggestion under the `# Install` header is to use a prebuilt binary like: https://github.com/haampie/libtree/releases/download/v3.1.1/libtree_x86_64 https://github.com/haampie/libtree/releases/download/v3.1.1/... The only verification provided is a sha256sum provided in the README, there's no way to confirm what source code or compiler was used to produce the binary, and no way to verify the binary was produced by that github user / that the README sha256 I was served was untampered with. I would propose that the 'unsafe' curl method is in fact probably safer than the recommended-first choice in the README.
- cozzyd 2y agoyeah, I went with the safer method of `sudo dnf install libtree-ldd`
- deleted 2y ago[deleted]
- exe34 2y agoi wrote a horrible little script to use ldd recursively on nixos to figure out what I need to include to run a closed source binary, will give this one a go if I ever try that again.
- srott 2y agolibvorbis/ogg as a vim dependency, interesting
- arp242 2y agoIt supports playing audio files; got added quite a few years back. :help sound-functions.
- stefantalpalaru 2y ago[dead]
- deleted 2y ago[deleted]
- smoors 2y agosimilar tool: lddtree https://github.com/gentoo/pax-utils/tree/master https://github.com/gentoo/pax-utils/tree/master
- vkoskiv 2y agoIn case anyone else is wondering what the colors mean (I couldn't find this in the manpage/README): Magenta: In exclude list (only shown with -v[v[v]]) Blue: Seen before (so you can spot which dependencies appear multiple times)
- tpoacher 2y agoNot sure if it's a bug, but I get different libraries from ldd and libtree for the vim example (e.g. linux-vdso.so.1 appears top of the list on ldd but not at all on libtree)
- dividuum 2y agolinux-vdso.so.1 isn't a real library you'll find anywhere in the file system and it's not referenced within the ELF file, so libtree doesn't know about it. Instead it is mapped into the address space of a newly started process automatically by the kernel. It's an optimization feature to avoid syscall overhead for function like gettimeofday. See https://man7.org/linux/man-pages/man7/vdso.7.html https://man7.org/linux/man-pages/man7/vdso.7.html
- mrspuratic 2y agoIf you compile the Linux kernel you will have in the build directory the actual .so file(s) which are ultimately embedded in the kernel. They don't ever get installed as conventional libraries (since they are not), but they are otherwise real shared dynamic ELF binaries. If you're curious you can make a copy: 1. grab the vdso offset XX in memory of, for example, the running shell gawk -n -vFS=- '/\[vdso\]/{printf("%i",("0x"$1)/4096)}' /proc/$$/maps 2. extract that page dd if=/proc/$$/mem of=linux-vdso.so bs=4096 count=1 skip=XX where XX is the offset from step 1 3. check with nm -D linux-vdso.so objdump -ad -j .text linux-vdso.so
- Joker_vD 2y agoOh, so it's like kernel32.dll on the Windows side of things?
- account42 2y agoNo, kernel32.dll is a real library that is referenced in the import section of executables and libraries that need it.
- 2y ago
- amelius 2y agoShouldn't it print a DAG instead of a tree?
- stabbles 2y agoIt prints a DAG as a tree: every line is an edge, identical nodes are repeated. With `-vvv` it prints all possible paths as a tree.
- fwip 2y agoSeems a bit harder to print a DAG in a terminal in a readable way, even if the output is shorter.
- xelxebar 2y agoSomething like the output of `git log --graph` maybe? The tree unfolding is probably more than sufficient, though, given the size of typical DT_NEEDED lists.