I have binary than running on Arm , static and striped.

I don't know which compiler compiled this binary.

How can I identify function like fread sleep printf ioctl


There is no easy way to do that.

Several approaches:

  1. Build your own libc for ARM and then do a compare using IDA FLIRT, bindiff, diaphora or similar, or just use is as a reference to see how those function should look like.

  2. Look for the most referenced functions, a good chance that some of them will be libc. After finding some, look at the neighbor functions, good chance they will be also libc.

IdaPython script for the most referenced functions:

import idautils

funcs = {}
for func_addr in Functions():
    funcs[hex(func_addr)] = len(list(idautils.XrefsTo(func_addr, 1)))

referenced_funcs = sorted(funcs.items(), key=lambda kv: kv[1])
  1. If you look for a specific libc function, you can try to filter the functions in your binary by features like the number of parameters, referenced strings, numeric values inside and so on.
  • How can I find the most referenced functions? – wfj96649BcaooCom Jan 14 '20 at 18:36
  • I added a script for that in the answer. – macro_controller Jan 15 '20 at 8:04

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.