1

I am using IDA pro to decompile a series of applications. These applications share a common feature and what I have found is that in each decompilation each application shares the same set of functions. If the binary is stripped how does IDA pro work out the function names ?

The functions that I am seeing in common between the applications are all very abstract, for example v404(), and as far as I can work out don't come from any open source library set of functions.

Improve this question
2
  • 4
    Can you give some examples of the function names that you're seeing?
    – Jason Geffner
    Oct 7, 2014 at 21:17
  • 1
    v404()? Hm, mine always look like sub_<address of function>(params)
    – Gizmo
    Oct 9, 2014 at 17:44

1 Answer 1

Reset to default
3

I've seen 4 naming conventions being used:

  • vNNN() when decompiling ARM binaries (i.e.: Android JNI code) - not sure how it numbers them as it doesn't seem it's related to their position or address within the binary.
  • sub_HHHHHH() when decompiling x86/64 binaries (i.e.: for Windows, OSX) with the actual address on the name
  • _name/__name() for functions IDA is able to identify via its FLIRT algorithm
  • finally the clear names for functions it has enough information on the binaries to reverse as they were named originally.
Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.