1

I am attempting to reverse-engineer an old DOS executable, which seems to have been compiled around 1992 using Microsoft's C compiler at the time.

When opening the executable in Ghidra no imports are listed, so I assume that any library functions that were utilised have been statically linked. Certain strings exist such as %s%s, so I can assume that printf has been utilised, for example.

However, when looking through the code, nothing stands out as obviously being library code. Is there a way to identify library functions just from looking at the assembly/decompiled output?

Thanks, James

1 Answer 1

2

You could make use of FLIRT signatures.

There's a Python script porting IDA FLIRT for Ghidra. You can use existing signature sets, for instance github.com/Maktm/FLIRTDB (or make and apply your own signatures if needed).

If you need a tutorial on Ghidra setup here's a decent one.

1
  • 1
    Thanks for that. I'll look into FLIRT signatures. I've added the script to Ghidra, I just need to locate some 16-bit signature sets now. THanks.
    – jttri777
    Commented Aug 28, 2023 at 18:17

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.