I have a statically linked binary which is stripped. When I load it in IDA Pro, I don't see the function names as expected.
I generated the sig file for libc on the Linux machine on which the program was compiled and then used this sig file in IDA Pro, most of the function names are resolved, however few functions are still not resolved. I want to know the following:
- Why are some function names not resolved even though I have used the sig file for libc from the machine on which the program was compiled?
- How do I resolve all the function names?
I have marked the functions in the disassembly below which I hope to resolve using the sig file:
push rbp mov rbp, rsp sub rsp, 20h mov [rbp+var_14], edi mov [rbp+var_20], rsi mov [rbp+var_8], 0 mov [rbp+var_4], 0 lea rax, [rbp+var_8] mov rsi, rax mov edi, offset unk_4937E4 mov eax, 0 call sub_407FF0 // should be scanf function mov edx, [rbp+var_8] mov eax, [rbp+var_8] imul eax, edx mov [rbp+var_4], eax mov eax, [rbp+var_4] mov esi, eax mov edi, offset aTheResultIsD ; "the result is: %d\n" mov eax, 0 call sub_407EC0 // should be printf function mov eax, 0 leave retn
Specifically, the functions, scanf and printf.
Now, to generate the sig file, I used flair tools of IDA Pro and on the Linux machine, I generated using the following commands:
./pelf /usr/lib/x86_64-linux-gnu/libc.a libc.pat ./sigmake libc.pat libc.sig
from the exc file generated by sigmake, I removed the first 4 lines:
;--------- (delete these lines to allow sigmake to read this file) ; add '+' at the start of a line to select a module ; add '-' if you are not sure about the selection ; do nothing if you want to exclude all modules __iswctype 32 49F3 31C04885F674498B0E89FAD3EA3B5604733E83C2058B149685D274348B4E0841 __iswctype_l 32 49F3 31C04885F674498B0E89FAD3EA3B5604733E83C2058B149685D274348B4E0841 __chk_fail 00 0000 4883EC08BF........E8............................................ __stack_chk_fail 00 0000 4883EC08BF........E8............................................
I then, ran sigmake once again to generate the sig file:
./sigmake libc.pat libc.sig
Then, I placed this sig file inside the sig folder of IDA Pro and applied the signature (Shift + F5 in IDA pro). Now, 783 functions were resolved.
However, in the main subroutine,
printf functions are still not resolved.
If someone wants to take a look at the statically compiled binary, I have uploaded it here: