0

A lot of reverse engineering tutorials I've seen involve using the import address table to determine what functions a program calls based on which libraries it imports. But doesn't static linking a binary cause the libraries to be copied directly into the image, thus leaving the IAT blank? If so, wouldn't linking an executable statically at least make reverse engineering more difficult?

I'm asking because I haven't seen static linking mentioned as an anti-RE method. Is it effective in that role, or are libraries still listed in the IAT despite static linking?

Improve this question

2 Answers 2

Reset to default
2

You can't really use static linking for system APIs on Windows because syscall numbers change from one release to another. You pretty much have to go through one of the system DLLs in the end.

Improve this answer
2
  • 1
    While this is true (refer to j00ru.vexillium.org/ntapi), nothing prevents you from doing this for a specific windows version. Consider malware
    – Nordwald
    Commented Sep 23, 2016 at 8:57
  • 1
    Is having a system call number for a specific version sufficient where would you get the actual code that would be executed setting aside the syscall number changes
    – blabb
    Commented Sep 23, 2016 at 13:27
1

Its true function symbols are a great help when reversing unknown executables and static linking omits these symbols. On the other hand, there are techniques like IDA F.L.I.R.T.

These techniques try to determine if a function is a known library function through the use of signatures. In recent research, there are other approaches using machine learning.

So effectively, you won't trick a reverse engineer with it. Dynamic loading is a whole other method and may take more time to reverse, depending on its implementation.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.