How can dlsym successfully import function from stripped binary library?

It's weird that dlsym can import functions from stripped binaries.

Can anyone tell me why/how?

=== FILE: a.c ===
int a1() { return 1; }
int a2() { return 2; }
=== end of a.c ===

=== FILE: b.c ===
#include <stdio.h>
#include <dlfcn.h>
#include <stdlib.h>

typedef int (*fint)();

fint dlsym_fint(void *handle, char *name)
{
    fint x = (fint)dlsym(handle, name);
    char *err = NULL;
    if ((err = dlerror()) != NULL) {
        printf("dlsym: %s\n", err);
        exit(1);
    }
    return x;
}

int main()
{
    void *dl = dlopen("a.so", RTLD_NOW);
    fint a = NULL;
    a = dlsym_fint(dl, "a1");
    printf("%p: 开发者_高级运维%d\n", a, a());
    a = dlsym_fint(dl, "a2");
    printf("%p: %d\n", a, a());
    return 0;
}
=== end of b.c ===

$ gcc -shared -fPIC -o a.so a.c
$ nm a.so
...
00000000000004ec T a1
00000000000004f7 T a2
...

$ strip a.so
$ nm a.so
nm: a.so: no symbols

$ gcc -o b b.c -ldl

$ ./b
0x2aaaaaac74ec: 1
0x2aaaaaac74f7: 2

Try readelf -s a.so. The dynamic symbols are still there after that strip.

(Or just switch to nm -D a.so.)

strip removes debugging symbol tables, not the dynamic symbol tables used by the dynamic linker. To remove those symbols as well, use -fvisibility=hidden, and the symbol visibility function/variable attributes to select which functions you want to expose.