7

Why can't IDA Pro successfully determine which exact functions are called after successful disassembly of inline functions?

For example, statically linked functions like printf(), memcpy(), memset() are not recognized correctly. Is there a plugin/workaround to fix this issue?

6

IDA recognizes standard library functions based on IDA's FLIRT libraries. If IDA isn't detecting statically linked standard library functions in your disassembly, it's likely because

  1. You don't have the correct FLIRT library loaded, or
  2. IDA doesn't have a FLIRT library for the compiler that created your binary (IDA natively supports these compilers)

You can solve #1 by opening the Type Libraries subview in IDA (View -> Open subviews -> Type libraries) and pressing Ins and choosing the correct compiler.

Alternatively, you can solve #2 by using FLAIR to create your own FLIRT library for the correct compiler.

  • thank you for your fast reply so it's possible to ida not recognize compiler correctly and we have to define true FLIRT. – n00b Jun 19 '13 at 17:48
  • for #1 solution, does that mean you need to remove the already loaded libraries and pick the 'correct one' instead? IDA is detecting vs6win library to be used for my decompiled project so was wondering if I need to remove that on top of selecting the alternative. – Roberto Andrade Nov 17 '14 at 18:49
  • This didn't work for me, I posted details on a separate question if you guys are interested: reverseengineering.stackexchange.com/questions/6649/… – Roberto Andrade Nov 17 '14 at 21:42

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.