When I open cpp static binary, how can identify known functions like fopen/ioctl/printf? They have been compiled statically into the binary.
I dont know the compiler of this binary .
Reverse Engineering Stack Exchange is a question and answer site for researchers and developers who explore the principles of a system through analysis of its structure, function, and operation. It only takes a minute to sign up.Sign up to join this community
As far as I know, there are 3 approaches that have been implemented to identify library functions:
An experimental approach based on machine learning techniques was explored by Google Project Zero's Thomas Dullien in his article "Searching statically-linked vulnerable library functions in executable code: Helping researchers find 0ld days", in which he experimented with using similarity hashing combined with distance metrics in an attempt to identify functions across binaries generated by different compiler toolchains and compilation options. The article also mentions alternative approaches in published research, but besides MACHOC there is no public code or implementation available.