Ida Pro doesn't recognize known function

Question

I open statically Arm binary with Ida Pro.

While I reversing I find out some function like strstr and memcpy and etc. That Ida doesn't understand that those function are strstr and memcpy(for example)

Why is that? Why Ida cannot recognize such famous function? How can I "help" Ida to recognize functions like that.

That makes my reversing more easier.

The IDA "SDK and Utilities" download from the Hexrays website has all the tools required to roll your own. In fact the purpose of these is that within your very own niche you can create signatures for well-known functions for oft-used targets without having to rely on those from the makers. — 0xC0000022L, Sep 13 '21 at 10:55
Does this answer your question? IDA pro and default windows (lib) functions — R4444, Sep 13 '21 at 22:13

score 1 · Answer 1 · edited Sep 13 '21 at 11:28

I think you are looking for something called FLIRT signature. You can use them to identify common definitions from various libraries. You just need to download the flirt signatures, and let IDA do the work.

A public flirtdb repo can be found on github here. You can search for others on google too.

Edit: My bad, totally missed out the ARM linux part. Unfortunately, these signatures are not built into IDA, although I think IDA might have provided some default ones. For ARM linux, I can't seem to find any public ones online, so you may have to generate your own signatures. To do so, you basically generate signatures off precompiled library files. Check out this guide I found and see if it works for you.

Ida Pro doesn't recognize known function

1 Answers1