1

I am using IDA pro to decompile a series of applications. These applications share a common feature and what I have found is that in each decompilation each application shares the same set of functions. If the binary is stripped how does IDA pro work out the function names ?

The functions that I am seeing in common between the applications are all very abstract, for example v404(), and as far as I can work out don't come from any open source library set of functions.

  • 4
    Can you give some examples of the function names that you're seeing? – Jason Geffner Oct 7 '14 at 21:17
  • 1
    v404()? Hm, mine always look like sub_<address of function>(params) – Gizmo Oct 9 '14 at 17:44
3

I've seen 4 naming conventions being used:

  • vNNN() when decompiling ARM binaries (i.e.: Android JNI code) - not sure how it numbers them as it doesn't seem it's related to their position or address within the binary.
  • sub_HHHHHH() when decompiling x86/64 binaries (i.e.: for Windows, OSX) with the actual address on the name
  • _name/__name() for functions IDA is able to identify via its FLIRT algorithm
  • finally the clear names for functions it has enough information on the binaries to reverse as they were named originally.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.