const {P,H2,H3,Callout,Code,Ul,Related,PostHead}=window;
function Article(){
return <>
<PostHead cat="/CONCEPT" date="2026-07-20" title="What “stripped” actually means" lede="strip removes names, not code. The decompiler still sees instructions. It invents structs because you took away the dictionary, not because the bytes vanished."/>
<P>Clients say “it’s stripped” as if the binary were empty. Analysts say “it’s stripped” as if Ghidra were useless. Both are wrong. Stripping is a specific, boring transformation. Once you name it, the desk gets quieter.</P>
<H2>ELF, in practice</H2>
<P>On ELF, <span style={{fontFamily:'var(--font-mono)',fontSize:13}}>strip</span> typically drops <span style={{fontFamily:'var(--font-mono)',fontSize:13}}>.symtab</span> and debug sections. <span style={{fontFamily:'var(--font-mono)',fontSize:13}}>.dynsym</span> stays if the binary is dynamically linked — you still see imports and exported symbols. A fully static, fully stripped ELF is the annoying case: almost no names, still all of the code.</P>
<Code lang="sh">{`readelf -S sample | egrep 'symtab|dynsym|debug'
# .symtab gone, .dynsym present  →  stripped, but imports remain
# both gone, static              →  names are gone, bytes are not`}</Code>
<H2>PE and PDB</H2>
<P>A Windows build without PDB is not “encrypted.” It is missing the sidecar that mapped RVAs to names and types. Exports in the EAT still exist for DLLs. Kernel work without PDB is a different pain; we do not pretend Ghidra will grow NT symbols by wishing.</P>
<H2>Mach-O</H2>
<P>strip plus absent dSYM. Objective-C and Swift still leak class and selector names unless the build ran a dedicated obfuscator. That leak is a gift. Use it. Do not assume it is always there.</P>
<H2>What the decompiler invents</H2>
<P>Without types, Hex-Rays and Ghidra guess field widths from access patterns. They are often close and sometimes padded wrong. Execute the loads, see which displacements fire. The recovered struct is a measurement. The decompiler window is a draft.</P>
<Callout>Packed is not stripped. Packed means the real image is not what file(1) sees yet. Unpack or stop. Do not decompile the stub and call it the product.</Callout>
<H2>What we write in the report</H2>
<Ul items={[
'Linked how (static / dynamic), stripped how (symtab / debug / both).',
'Which names we still had (imports, exports, Objective-C).',
'Which layouts are confirmed vs guessed.',
'What we did not recover — empty cells, not fiction.'
]}/>
<Related items={[
['post-loops.html','From prompts to loops']
]}/>
</>;
}
window.Article=Article;
mountPost();