0

I'm trying to find libc symbols in some Windows 32-bit application. For some reason, Ida autoanalysis didn't recognized code that comes from libc as "library function", but as a "regular function". Let me make it more clear with some screenshots.

My tutor got the following result (sorry for the low quality, I describe whats in it after the shot): enter image description here This is the same image and you (maybe) can see that the malloc function at 0xE0E5DE is recognized as library function. The whole neighborhood is recognized as library function, since this section is for static-linked libc symbols.

But when I'm loading the image its a "regular function", and of course it doesn't resolve as malloc(): enter image description here

I tried to re-autoanalyze the code (Options --> General --> Reanalyze Program) but it didn't help. Hence I'm asking for help:

  1. Is there another automatic way to make IDA "notice" this code comes from static linking of a library?
  2. Maybe there is a manual way to do it? like: marking a code chunk as library function and compare it against libc?

P.S: the app was once packed with UPX, I decompress it. I don't believe it has anything to do with this problem, but maybe it has so I'm mentioning it

  • 3
    If static functions are not recognized by Ida this usually means that there are no FLIRT signatures available for the library version/variant used in the binary. Ida comes with a lot of pre-calculated FLIRT signatures but of course it can not contain signatures for each and every combination of library version and used compiler. See also hex-rays.com/products/ida/tech/flirt/in_depth – Robert May 25 at 12:20
3

There can be multiple reasons.

  1. the FLIRT signatures which have been loaded automatically do not have a pattern for this specific function. You can check which signatures have been applied and try loading additional ones via Signatures view (Shift-F5).

  2. the function pattern was conflicting with another function(s) and has been dropped from the final signature file. If you have the original library with the function, you can try creating your own signature.

  3. The function has been modified from the standard one so the matching failed

You can try enabling FLIRT diagnostic output by stating IDA with -z4 command line switch and observe if the address in question is mentioned in the log. Maybe that will give some clues about why it hasn't been matched.

| improve this answer | |
  • Using Shift-F5 I was able to load the signatures of vc32rtf and now this code is recognized as C runtime library. Thanks a lot! – Z E Nir May 25 at 15:25

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.