Unable to resolve the symbols for a statically linked binary in IDA Pro

Question

I have a statically linked binary which is stripped. When I load it in IDA Pro, I don't see the function names as expected.

I generated the sig file for libc on the Linux machine on which the program was compiled and then used this sig file in IDA Pro, most of the function names are resolved, however few functions are still not resolved. I want to know the following:

1. Why are some function names not resolved even though I have used the sig file for libc from the machine on which the program was compiled?
2. How do I resolve all the function names?

I have marked the functions in the disassembly below which I hope to resolve using the sig file:

push    rbp
mov     rbp, rsp
sub     rsp, 20h
mov     [rbp+var_14], edi
mov     [rbp+var_20], rsi
mov     [rbp+var_8], 0
mov     [rbp+var_4], 0
lea     rax, [rbp+var_8]
mov     rsi, rax
mov     edi, offset unk_4937E4
mov     eax, 0
call    sub_407FF0  // should be scanf function
mov     edx, [rbp+var_8]
mov     eax, [rbp+var_8]
imul    eax, edx
mov     [rbp+var_4], eax
mov     eax, [rbp+var_4]
mov     esi, eax
mov     edi, offset aTheResultIsD ; "the result is: %d\n"
mov     eax, 0
call    sub_407EC0 // should be printf function
mov     eax, 0
leave
retn

Specifically, the functions, scanf and printf.

Now, to generate the sig file, I used flair tools of IDA Pro and on the Linux machine, I generated using the following commands:

./pelf /usr/lib/x86_64-linux-gnu/libc.a libc.pat

./sigmake libc.pat libc.sig

from the exc file generated by sigmake, I removed the first 4 lines:

;--------- (delete these lines to allow sigmake to read this file)
; add '+' at the start of a line to select a module
; add '-' if you are not sure about the selection
; do nothing if you want to exclude all modules

__iswctype                                          32 49F3 31C04885F674498B0E89FAD3EA3B5604733E83C2058B149685D274348B4E0841
__iswctype_l                                        32 49F3 31C04885F674498B0E89FAD3EA3B5604733E83C2058B149685D274348B4E0841

__chk_fail                                          00 0000 4883EC08BF........E8............................................
__stack_chk_fail                                    00 0000 4883EC08BF........E8............................................

I then, ran sigmake once again to generate the sig file:

./sigmake libc.pat libc.sig

Then, I placed this sig file inside the sig folder of IDA Pro and applied the signature (Shift + F5 in IDA pro). Now, 783 functions were resolved.

However, in the main subroutine, scanf and printf functions are still not resolved.

If someone wants to take a look at the statically compiled binary, I have uploaded it here:

https://www.sendspace.com/file/j9piey

Thanks.

Answer 1

1. the library you parsed was not an exact match for the binary. Check the bytes in the binary against the bytes in the library/pattern.
2. there was some other issue that prevented matching the signature. You can run IDA with -z4 switch to see extra debug output during FLIRT processing, it may give some clues.