I'm currently reversing a Linux 32-bit executable (with a statically linked library included in it) but I'm having a little problem I can't find a solution for.
Basically whenever I stumble across a glibc call (memset, memcpy, etc.) IDA, instead of showing the correct name of the function, it shows a reference to MEMORY as a function call.
MEMORY[0xACFC3F9F](s, 0, 44); // <----- memset MEMORY[0xACFC3FBD](dest, 0, 40); // <---- memset
The interesting part is that when debugging the reference changes to an actual function call (still unknown, but whatever). While debugging the MEMORY part changes to:
((void (__cdecl *)(char *, _DWORD, signed int))unk_F769B4F0)(s, 0, 44); ((void (__cdecl *)(char *, _DWORD, signed int))unk_F769B4F0)(dest, 0, 40);
In Ghidra the same code looks like this:
memset(s,0,0x2c); // <--- correct function name memset(dest,0,0x28); // <--- correct function name
IDA should automatically detect std library functions, what could be the reason why it isn't happening here?
Update: I re-analyzed the executable from scratch (creating a new IDA database) and the references to the functions are here.
Unfortunately, after attaching to the debugger all the function calls became "MEMORY" again.
Here's the asm:
.text:566146D7 mov [esp], eax ; s .text:566146DA call near ptr memset+566146DBh ; <--- memset call .text:566146DF mov dword ptr [esp+8], 28h ; '(' ; n .text:566146E7 mov dword ptr [esp+4], 0 ; c .text:566146EF lea eax, [ebp+dest] .text:566146F5 mov [esp], eax ; s .text:566146F8 call near ptr memset+566146F9h ; <--- memset call .text:566146FD movsx eax, [ebp+var_14C]
The memset calls are here but with a memory offset pointing to the next address of the executable.