1

As far I know that stripped binaries when we decompile it we can't know what most of functions (sub_XXXXXX) really do becuase they are not part of the binary's symbol table, so the names are automatically generated by IDA which called Dummy names

Dummy names are automatically generated by IDA. They are used to denote subroutines, program locations and data.
>> https://www.hex-rays.com/products/ida/support/idadoc/609.shtml

Yesterday I reverse-engineered a program and I used IDA Decompiler to see how the program works and i notices the dummy (functions) names, one of them after many hours trying to spot the implementation

enter image description here

I found out (accidentally) that it was strtol's implementation

https://code.woboq.org/gcc/libiberty/strtol.c.html

https://www.tutorialspoint.com/c_standard_library/c_function_strtol.htm


So is there a tricks/tips or tools maybe like FIRST (https://talosintelligence.com/first) to let us know what these functions are ?

P.S: The question is not exclusive to IDA

1

0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.