I'm trying to find
libc symbols in some Windows 32-bit application. For some reason, Ida autoanalysis didn't recognized code that comes from
libc as "library function", but as a "regular function". Let me make it more clear with some screenshots.
My tutor got the following result (sorry for the low quality, I describe whats in it after the shot):
This is the same image and you (maybe) can see that the
malloc function at
0xE0E5DE is recognized as library function. The whole neighborhood is recognized as library function, since this section is for static-linked
I tried to re-autoanalyze the code (
Options --> General --> Reanalyze Program) but it didn't help. Hence I'm asking for help:
- Is there another automatic way to make IDA "notice" this code comes from static linking of a library?
- Maybe there is a manual way to do it? like: marking a code chunk as library function and compare it against
P.S: the app was once packed with UPX, I decompress it. I don't believe it has anything to do with this problem, but maybe it has so I'm mentioning it