reconstructing symbols stripped from Mach-O binary

Question

Using Mac OS X 10.5 I'm trying to figure out how to use dtrace to track the execution of a Mach-O binary. However, it seems the symbols have all be stripped out so any attempts to put use probes based on internal class/method names fail.

I was able to use class-dump to dump the classes, method names and the address they are implemented at so I'm assuming you can use that to rebuild the symbols in the binary. Is that even possible, and if so does anyone know of any tools that might help with it or some reading materials that would help me understand it better?

This is my first attempt at working with binaries at this level so any help would be appreciated.

Answer 1

No, it's not possible. When the symbols get stripped, information is lost where exactly the code for each method starts. You would have to disassemble the code to reconstruct this information. If you merely know what the methods of each class are, you still don't know where they are located in the code, which is what dtrace needs.