Identifying C/C++ Library Functions

Question

I am attempting to reverse-engineer an old DOS executable, which seems to have been compiled around 1992 using Microsoft's C compiler at the time.

When opening the executable in Ghidra no imports are listed, so I assume that any library functions that were utilised have been statically linked. Certain strings exist such as %s%s, so I can assume that printf has been utilised, for example.

However, when looking through the code, nothing stands out as obviously being library code. Is there a way to identify library functions just from looking at the assembly/decompiled output?

Thanks, James

Answer 1

You could make use of FLIRT signatures.

There's a Python script porting IDA FLIRT for Ghidra. You can use existing signature sets, for instance github.com/Maktm/FLIRTDB (or make and apply your own signatures if needed).

If you need a tutorial on Ghidra setup here's a decent one.