0

I didn't understand the subject of find function in Ida via signature.

If I understand well that way helps to recognize libraries functions in static binary(in dynamic binary I can see the functions name) , and there is a database that contain lot of known functions with signatures, right?

So how can I use that? Is that build-in in Ida? Or is there any plugin that I need to use?

Improve this question

1 Answer 1

Reset to default
2

IDA works with FLIRT (Fast Library Identification and Recognition Technology) signatures. These “signatures” are basically sequences of assembly instructions that are found in functions. IDA has built-in signatures for common libraries. You can find signatures for other libraries, or create your own for functions you identify.

IDA also reads given names from debugging symbols and exports that are part of the binary and can read .pdb files with symbols for matching binaries.

Improve this answer
2
  • I didn't understand the using of FLIRT , if it is dynamic binary, you can see the function name, so IDA using FLIRT in static binary? Is that identify function automatically? Or do I need to do something?
    – yfr24493AzzrggAcom
    Commented May 3, 2020 at 18:46
  • IDA scans the binary using FLIRT signatures as part of its auto analysis. As anything, it could fail. You can force running the signature search, or change the FLIRT signature files in the file menu: File > Load > FLIRT signature file. If the code changes during dynamic execution (unpacking, etc.), run the signature search again.
    – Yotamz
    Commented May 4, 2020 at 8:29

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.