Implement a Binary Strip Tool

Stripping Debug Information

The strip command removes symbol tables and debug information from binaries, reducing file size and making reverse engineering harder. Release builds of commercial software are almost always stripped.

What Gets Removed vs. What Stays

Sections typically stripped:

• .symtab and .strtab: Full symbol table
• .debug_*: All DWARF debug sections
• .comment: Compiler version strings

Sections that must stay:

• .dynsym and .dynstr: Dynamic symbols needed at runtime
• .text, .data, .bss: Program code and data
• Program headers: Required for loading

For example, stripping a debug build might remove 2 MB of .debug_info while leaving the 50 KB .text section untouched.

For This Exercise

You will identify which sections would be removed by a strip operation and calculate the size reduction. Understanding what survives stripping tells you what information reverse engineers still have when analyzing a production binary.

Real-World Strip Impact

Running strip --strip-debug on a typical C project removes hundreds of kilobytes of DWARF data. Reverse engineers respond by relying on dynamic analysis, pattern matching, and FLIRT signatures when static symbols are gone. Understanding exactly what strip removes helps you assess how much information survives in a production binary you receive during an incident response engagement.