1

I'm currently reversing a Linux 32-bit executable (with a statically linked library included in it) but I'm having a little problem I can't find a solution for.

Basically whenever I stumble across a glibc call (memset, memcpy, etc.) IDA, instead of showing the correct name of the function, it shows a reference to MEMORY as a function call.

Example:

MEMORY[0xACFC3F9F](s, 0, 44);    // <----- memset
MEMORY[0xACFC3FBD](dest, 0, 40); // <---- memset

The interesting part is that when debugging the reference changes to an actual function call (still unknown, but whatever). While debugging the MEMORY part changes to:

((void (__cdecl *)(char *, _DWORD, signed int))unk_F769B4F0)(s, 0, 44);
((void (__cdecl *)(char *, _DWORD, signed int))unk_F769B4F0)(dest, 0, 40);

In Ghidra the same code looks like this:

memset(s,0,0x2c);    // <--- correct function name
memset(dest,0,0x28); // <--- correct function name

IDA should automatically detect std library functions, what could be the reason why it isn't happening here?


Update: I re-analyzed the executable from scratch (creating a new IDA database) and the references to the functions are here.

Unfortunately, after attaching to the debugger all the function calls became "MEMORY" again.

Here's the asm:

.text:566146D7                 mov     [esp], eax      ; s
.text:566146DA                 call    near ptr memset+566146DBh ; <--- memset call
.text:566146DF                 mov     dword ptr [esp+8], 28h ; '(' ; n
.text:566146E7                 mov     dword ptr [esp+4], 0 ; c
.text:566146EF                 lea     eax, [ebp+dest]
.text:566146F5                 mov     [esp], eax      ; s
.text:566146F8                 call    near ptr memset+566146F9h ; <--- memset call
.text:566146FD                 movsx   eax, [ebp+var_14C]

The memset calls are here but with a memory offset pointing to the next address of the executable.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.