You may have overlooked one important thing about compiler, the for optimization purpose some "functions" are in fact macros rather than subroutines, especially the str*() series, e.g., strlen() is 90% implemented in macro on i86 target, but 50% subroutine on ARM. You may notice also the if you IDA your own code, the debug version always has the subroutine but the release one not because of optimization ...
A little knowledge about printf(...), it is in most situation a macro of fprintf(STDOUT,...) ...
I dont think it is easy to make signature for macros on i86 target, since the registers may not always the same except EAX ...
Quote:
|
Originally Posted by Wannabe
I am currently reversing an exe file which has the standard c-libs linked into it.
The problem is that IDA don't recognize basic calls like strcpy, printf and suchs, you have to realize it the hard way by going through the disassembly, or by debugging it ;-)
Is there a way to make IDA realize those calls for what they are? It would really help understanding the real stuff instead of realizing you're fooling around in printf  |