The focus of this is post is on extracting symbols of functions called through the Procedure Linkage Table (PLT) section in ELF binaries. As with many of my posts, I do not claim that the described approach is the most proper or best solution to the problem. Instead, I aim to share what worked for me — firstly, so I can document what I did, and secondly, in the hope that someone else may find it helpful.

This post is an indirect continuation of my earlier entry on using chroot and QEMU, and a rather bizarre issue that came up when trying to run a described steps on an Arm64 Linux machine (or more precisely a Linux VM running on M2 MacBook Pro). So, the developed automation worked simply fine when running on x86 GitHub runner, however I could not get QEMU to emulate 32-bits Arm binaries on the 64-bit Arm machine.

Before I start, a short disclaimer: I have not used GitHub Actions before, nor I am a chroot expert, so a better solution to my problem may exist. However, I hope that my personal experience may help anyone trying to start a similar project. Back to the post. After getting tired of manually building and testing MAMBO — a dynamic binary modification (DBM) system I am the maintainer of — on different architectures, I finally decided to create a simple GitHub Action to do it for me.