2

I am trying to reverse engineer an executable which uses Qt 5.5.1 graphic library and is compiled with MinGw 4.9.2. When i open it with IDA pro 6.8 all of the code appears as user code, without any recognised function. To help ida recognise the Qt functions i tryied to create the flirt signatures of the main Qt libraries. This resulted in lots and lots of collisions (sometimes all functions colliding). After trying to apply these new signatures with ida i don't get any match in the executable.

How can i generate flirt signatures for Qt 5.5.1 libraries?

**Edit:**I am working under windows and I am working with a windows executable

  • 1
    Not an answer to your question, but I've found Diaphora to be quite useful and more powerful for recognising functions. You will still have to build Qt using the same toolchain to have more accurate matches though. – Léo Lam Feb 21 '18 at 17:07
1

You need to build Qt 5.5.1 using MinGw 4.9.2. and guess all the build options that the developer used originally. Then use FLAIR for you IDA version to generate pat files from .a libraries. Then compile pat files into sig files. Put sig files to \IDA\sig and try to apply them.

  • I tried to generate the signature file but it found about 7000 functions all colliding together, so a quite useless signature – Rocco Mancin Jan 26 '18 at 13:20
  • yep there are a lot of small functions which you won't be able to detect by signatures – Anton Kukoba Jan 26 '18 at 13:31
  • Is there a possibility to "mark" these small functions to at least know they belong to a library instead as being user code? – Rocco Mancin Jan 29 '18 at 21:09
  • I'm not sure, maybe there's some way. I haven't tried to do so. Maybe there's something in FLAIR documentation. – Anton Kukoba Jan 30 '18 at 8:23

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.