2

I open statically Arm binary with Ida Pro.

While I reversing I find out some function like strstr and memcpy and etc. That Ida doesn't understand that those function are strstr and memcpy(for example)

Why is that? Why Ida cannot recognize such famous function? How can I "help" Ida to recognize functions like that.

That makes my reversing more easier.

Improve this question
2
  • The IDA "SDK and Utilities" download from the Hexrays website has all the tools required to roll your own. In fact the purpose of these is that within your very own niche you can create signatures for well-known functions for oft-used targets without having to rely on those from the makers.
    – 0xC0000022L ♦
    Sep 13, 2021 at 10:55
  • 2
    Does this answer your question? IDA pro and default windows (lib) functions
    – R4444
    Sep 13, 2021 at 22:13

1 Answer 1

Reset to default
1

I think you are looking for something called FLIRT signature. You can use them to identify common definitions from various libraries. You just need to download the flirt signatures, and let IDA do the work.

A public flirtdb repo can be found on github here. You can search for others on google too.

Edit: My bad, totally missed out the ARM linux part. Unfortunately, these signatures are not built into IDA, although I think IDA might have provided some default ones. For ARM linux, I can't seem to find any public ones online, so you may have to generate your own signatures. To do so, you basically generate signatures off precompiled library files. Check out this guide I found and see if it works for you.

Improve this answer
0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.