Stripped Binaries Are Not Anonymous

Stripping a binary removes the symbol table. It’s often described as if it removes the names of things, which is true but misleading — the structure survives untouched, and structure is most of what you actually read when reversing.

What stripping actually removes

strip drops .symtab and .strtab. Compare a binary before and after:

$ readelf --syms ./target | wc -l
412
$ strip ./target
$ readelf --syms ./target | wc -l
0

Zero symbols. But look at what’s left:

$ readelf --sections ./target | grep -E '\.(text|rodata|data|dynsym)'
  [11] .text     PROGBITS  0000000000001080  00001080
  [14] .rodata   PROGBITS  0000000000002000  00002000
  [18] .dynsym   DYNSYM    00000000000004c0  000004c0

.dynsym is still there, and it has to be — the dynamic linker needs it to resolve imports at load time. Every libc call the binary makes is still named.

Why that matters

Imports are a behavioural fingerprint. A binary importing socket, bind, and listen is a server. One importing ptrace is probably checking whether it’s being debugged. You haven’t recovered a single local function name, yet you already know roughly what the program does and where the interesting parts are.

Here is what survives, and what it gives you:

Section	Survives `strip`?	What it leaks
`.symtab`	No	Local function and variable names
`.strtab`	No	The string table backing those names
`.dynsym`	Yes	Every imported libc symbol, by name
`.rodata`	Yes	String literals and format specifiers
`.text`	Yes	The full call graph and control flow
`.eh_frame`	Yes	Function boundaries, via unwind tables

Add to that:

String literals in .rodata, complete with format specifiers that leak argument types and counts.
Cross-references — the call graph is intact, so a function called from thirty places is doing something load-bearing.
Function boundaries, recoverable from prologues and the exception-handling tables that .eh_frame still carries.

Stripping raises the cost of reading a binary. It doesn’t change what the binary says.

The practical takeaway for defenders is that stripping is not obfuscation, and treating it as a protection measure is a mistake. It removes convenience, not information.