Save Valuable Time Reverse Engineering

Question

As we know, time is the bane of reverse engineering. I am wanting to know how are some ways that I can save time in reverse engineering? I have taken some thought and I have been going through many programs and finding that even if the program is considerably different I am able to find up to 255+ identical garbage/redundant functions. I was thinking this morning if there was a way to somehow fingerprint these, that it would save me a considerable amount of time.

In short, I would like to know:
Has anyone tried to fingerprint or make a database of these redundant functions?

Also, what are some other ways that I can save time in my reversal process?

Answer 1

This is a common task when looking at binaries with statically linked code. The static code varies in register assignment, relative pointer addressing to external object code and other details but is mostly identical across binaries.

IDA uses the FLIRT system to solve this problem. https://www.hex-rays.com/products/ida/tech/flirt/in_depth.shtml

Basically it filters those bits that vary across linker executions and matches the remaining pattern against a list. For very short functions there are many collisions, but for functions longer than ~30 bytes or so it's very good at identifying what you're looking at.

If you're using IDA then it comes with the tools to create your own FLIRT signatures. If you're not using IDA then you would have to make a tool to pull apart your particular static libraries, disassemble the first opcodes, filter the variable bits (this is tricky), and create a database to link names to patterns. You could apply the patterns as appropriate: borland libraries for borland program, MS runtime for visual studio, etc.