Timeline for Function dependencies in static libraries
Current License: CC BY-SA 3.0
10 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Oct 21, 2016 at 8:44 | comment | added | 0xC0000022L♦ | @stackoverflowwww FLIRT was exactly created for this use case. Many of the signatures can cover whole ranges of versions of the same library (no matter the linkage type). So if you have access to the library in some version it's likely worthwhile to create FLIRT signatures from it and apply them. | |
| Jun 23, 2016 at 16:59 | comment | added | langlauf.io | thanks for your remarks. No problem if I miss something. Any solid dependency information is fine. | |
| Jun 23, 2016 at 16:30 | comment | added | user2823000 | Don't forget to recursively apply your algorithm on any function and ressources it'll find. Well there is no guarantee here, with such a static, you have no way to be sure you either missed computer paths or followed some behind opaque predicates. | |
| Jun 23, 2016 at 14:54 | comment | added | langlauf.io | the hint with the pointer arithmetic is a good one. I hope IDA would not give me any xrefs that are false positives, right? | |
| Jun 23, 2016 at 14:50 | comment | added | langlauf.io | heuristic: I don't know which is the correct source code. I know it is e.g. Libpng but I don't know which version. I don't know exactly which compiler flags were used to build it. | |
| Jun 22, 2016 at 23:07 | comment | added | user2823000 | Regarding the heuristic, it's really a case-by-case specific problem. If you know the compilation settings, just go with the usual tools stated in my answer. If you only have the source code, I'd try to match either the function prototypes or the error messages as generic pieces of advice, but it's hard to tell if that'll be suited to your library. | |
| Jun 22, 2016 at 23:02 | comment | added | user2823000 | Regarding the dependencies of a single function in the library, I'd go for some IDA Python. A really naive first approach would be to include anything that has a xref from your function, and to double-check there is no pointer arithmetic whatsoever. | |
| Jun 22, 2016 at 17:34 | comment | added | langlauf.io | Let's assume my library is clean enough. How would you try to get the dependencies? | |
| Jun 22, 2016 at 17:29 | comment | added | langlauf.io | Good point, Indeed, I know the library but not the version. And yes, I am thinking about a heuristic how to compare it with multiple versions. My intution was that the answer to my questions would help in coming up with a suitable heuristic | |
| Jun 22, 2016 at 17:24 | history | answered | user2823000 | CC BY-SA 3.0 |