2

As far I know that stripped binaries when we decompile it we can't know what most of functions (sub_XXXXXX) really do becuase they are not part of the binary's symbol table, so the names are automatically generated by IDA which called Dummy names

Dummy names are automatically generated by IDA. They are used to denote subroutines, program locations and data.
>> https://www.hex-rays.com/products/ida/support/idadoc/609.shtml

Yesterday I reverse-engineered a program and I used IDA Decompiler to see how the program works and i notices the dummy (functions) names, one of them after many hours trying to spot the implementation

enter image description here

I found out (accidentally) that it was strtol's implementation

https://code.woboq.org/gcc/libiberty/strtol.c.html

https://www.tutorialspoint.com/c_standard_library/c_function_strtol.htm


So is there a tricks/tips or tools maybe like FIRST (https://talosintelligence.com/first) to let us know what these functions are ?

P.S: The question is not exclusive to IDA

1

1 Answer 1

1

The solution to this problem would probably be the use of function signatures. Most common re tools like IDA (FLIRT), ghidra and r2 (zignatures) support this. The only problem is that if the signatures for the libraries your executable was compiled against don't exist in the community you have to create them yourself

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.