Identify function in cpp static binary

Question

When I open cpp static binary, how can identify known functions like fopen/ioctl/printf? They have been compiled statically into the binary.

I dont know the compiler of this binary .

Answer 1

As far as I know, there are 3 approaches that have been implemented to identify library functions:

1. IDA FLIRT essentially uses byte patterns to create function signatures
2. Ghidra's FunctionID feature takes mnemonic and operand type into account when hashing instructions to match functions to their well-known name
   • this is according to Willi Ballenthin's analysis
   • hashing implementation
3. JEB's disassembler creates function signatures by hashing the assembly (not binary code) of the function with a custom hashing algorithm.

An experimental approach based on machine learning techniques was explored by Google Project Zero's Thomas Dullien in his article "Searching statically-linked vulnerable library functions in executable code: Helping researchers find 0ld days", in which he experimented with using similarity hashing combined with distance metrics in an attempt to identify functions across binaries generated by different compiler toolchains and compilation options. The article also mentions alternative approaches in published research, but besides MACHOC there is no public code or implementation available.