4

I am trying to reverse engineer an executable which uses Qt 5.5.1 graphic library and is compiled with MinGw 4.9.2. When i open it with IDA pro 6.8 all of the code appears as user code, without any recognised function. To help ida recognise the Qt functions i tryied to create the flirt signatures of the main Qt libraries. This resulted in lots and lots of collisions (sometimes all functions colliding). After trying to apply these new signatures with ida i don't get any match in the executable.

How can i generate flirt signatures for Qt 5.5.1 libraries?

**Edit:**I am working under windows and I am working with a windows executable

Improve this question
1
  • 1
    Not an answer to your question, but I've found Diaphora to be quite useful and more powerful for recognising functions. You will still have to build Qt using the same toolchain to have more accurate matches though.
    – Léo Lam
    Feb 21, 2018 at 17:07

1 Answer 1

Reset to default
3

You need to build Qt 5.5.1 using MinGw 4.9.2. and guess all the build options that the developer used originally. Then use FLAIR for you IDA version to generate pat files from .a libraries. Then compile pat files into sig files. Put sig files to \IDA\sig and try to apply them.

Improve this answer
4
  • I tried to generate the signature file but it found about 7000 functions all colliding together, so a quite useless signature
    – Rocco Mancin
    Jan 26, 2018 at 13:20
  • yep there are a lot of small functions which you won't be able to detect by signatures
    – Anton Kukoba
    Jan 26, 2018 at 13:31
  • Is there a possibility to "mark" these small functions to at least know they belong to a library instead as being user code?
    – Rocco Mancin
    Jan 29, 2018 at 21:09
  • I'm not sure, maybe there's some way. I haven't tried to do so. Maybe there's something in FLAIR documentation.
    – Anton Kukoba
    Jan 30, 2018 at 8:23

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.