9

Why can't IDA Pro successfully determine which exact functions are called after successful disassembly of inline functions?

For example, statically linked functions like printf(), memcpy(), memset() are not recognized correctly. Is there a plugin/workaround to fix this issue?

Improve this question

1 Answer 1

Reset to default
7

IDA recognizes standard library functions based on IDA's FLIRT libraries. If IDA isn't detecting statically linked standard library functions in your disassembly, it's likely because

  1. You don't have the correct FLIRT library loaded, or
  2. IDA doesn't have a FLIRT library for the compiler that created your binary (IDA natively supports these compilers)

You can solve #1 by opening the Type Libraries subview in IDA (View -> Open subviews -> Type libraries) and pressing Ins and choosing the correct compiler.

Alternatively, you can solve #2 by using FLAIR to create your own FLIRT library for the correct compiler.

Improve this answer
3
  • thank you for your fast reply so it's possible to ida not recognize compiler correctly and we have to define true FLIRT.
    – n00b
    Jun 19, 2013 at 17:48
  • for #1 solution, does that mean you need to remove the already loaded libraries and pick the 'correct one' instead? IDA is detecting vs6win library to be used for my decompiled project so was wondering if I need to remove that on top of selecting the alternative.
    – Roberto Andrade
    Nov 17, 2014 at 18:49
  • This didn't work for me, I posted details on a separate question if you guys are interested: reverseengineering.stackexchange.com/questions/6649/…
    – Roberto Andrade
    Nov 17, 2014 at 21:42

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.