ida identifies library function as regular function

Question

I'm trying to find libc symbols in some Windows 32-bit application. For some reason, Ida autoanalysis didn't recognized code that comes from libc as "library function", but as a "regular function". Let me make it more clear with some screenshots.

My tutor got the following result (sorry for the low quality, I describe whats in it after the shot): This is the same image and you (maybe) can see that the malloc function at 0xE0E5DE is recognized as library function. The whole neighborhood is recognized as library function, since this section is for static-linked libc symbols.

But when I'm loading the image its a "regular function", and of course it doesn't resolve as malloc():

I tried to re-autoanalyze the code (Options --> General --> Reanalyze Program) but it didn't help. Hence I'm asking for help:

1. Is there another automatic way to make IDA "notice" this code comes from static linking of a library?
2. Maybe there is a manual way to do it? like: marking a code chunk as library function and compare it against libc?

P.S: the app was once packed with UPX, I decompress it. I don't believe it has anything to do with this problem, but maybe it has so I'm mentioning it

Answer 1

There can be multiple reasons.

1. the FLIRT signatures which have been loaded automatically do not have a pattern for this specific function. You can check which signatures have been applied and try loading additional ones via Signatures view (Shift-F5).

2. the function pattern was conflicting with another function(s) and has been dropped from the final signature file. If you have the original library with the function, you can try creating your own signature.

3. The function has been modified from the standard one so the matching failed

You can try enabling FLIRT diagnostic output by stating IDA with -z4 command line switch and observe if the address in question is mentioned in the log. Maybe that will give some clues about why it hasn't been matched.