When I open cpp static binary, how can identify known functions like fopen/ioctl/printf? They have been compiled statically into the binary.
I dont know the compiler of this binary .
As far as I know, there are 3 approaches that have been implemented to identify library functions:
An experimental approach based on machine learning techniques was explored by Google Project Zero's Thomas Dullien in his article "Searching statically-linked vulnerable library functions in executable code: Helping researchers find 0ld days", in which he experimented with using similarity hashing combined with distance metrics in an attempt to identify functions across binaries generated by different compiler toolchains and compilation options. The article also mentions alternative approaches in published research, but besides MACHOC there is no public code or implementation available.