title: Finding functions address on the fly
body: <p>My goal is to hook C functions with no symbol in stripped binaries on ARM platform. As the addresses of these functions may changed (ie. with an update of the binary), I want my interposing dynamic library itself to find the addresses.</p>
  
  <p>Moreover, these functions, at some point, uses an C-string which never changes through updates. With this in mind, here are the 3 steps to find the functions address:</p>
  
  <p>1) find the address of the C-string itself ( by analyzing the <code>__cstring</code> section inside the <code>__TEXT</code> segment.</p>
  
  <p>2) find the address of the reference to the string.</p>
  
  <p>3) Starting from the xref address, go backwards until I find a function prologue.</p>
  
  <p>I could implement step 1) and 3), but I'm a bit lost for 2). What is exactly an xref ? How can I identify the one corresponding to the C-string ? No code is needed, just some theory.</p>
  
  <p>Thanks !</p>