I asked the question a while ago but found no answer so I'm trying my luck again

the only solution is this :

Finding all API calls in a function

but it doesn't work when the library call is a .NET library call, and it seems like it doesn't include calling to recognized staticley linked library calls that were recognized by flirt

basically i just want to check if a call instruction is a API/Library call or just a local function call

I already tried to use the GetOpType function but didnt work, both of the "local" calls and library calls will return 10 :

void [mscorlib]System.Threading.Thread::Sleep(int32)

unsigned int8[] Loader.Nyan::AES_Decrypt(unsigned int8[] bytesToBeDecrypted)
10 (LOCAL function)

Currently I'm using regex as a dirty workaround to find library calls only if there is a [*] in the operand but there has to be a better way..

as another work around I'm checking to see if the last byte of call is 0x0A or not, based on experience all the library calls have this byte at the end, not sure if its gonna work for all the calls or not

  • You might be able to check “local” calls by checking what section the call points to. For a typical C program local calls will be to the same code section. Unsure how this works with .Net.
    – David
    Aug 23, 2020 at 19:58
  • 1
    @David Thanks for answer, but this will not detect statically linked library calls (that were detected by flirt), and its not gonna generalize well. its just weird that they didn't include a simple API call to check if a call is library call or not, it seems like this actually is implemented considering in IDA you can clearly see if a call is library call or not based on coloring and other stuff
    – OneAndOnly
    Aug 24, 2020 at 4:09
  • in that case, check my simple is_library_func() from this gist: gist.github.com/edeca/716c38cc78c5df17120583c203c1640d
    – David
    Aug 24, 2020 at 15:42
  • 1
    @David yes i am aware the LIB flags, but in .net, using GetOpnd API call will return you the name of the operand, there is no address so i can use against the lib flag, Im not sure how to get the operand value as a actual address instead of name, even the raw bytes of call instructions in .NET are not address or offset, they are some sort of index in a table
    – OneAndOnly
    Aug 24, 2020 at 15:53


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.