IDA pro cannot recognize some static compiled library in a pe file

Asked Aug 11 '15 at 16:36

Active Aug 11 '15 at 16:51

Viewed 1,215 times

I'm reversing a PE file and I think the exe uses some library compiled static.

Now IDA can recognize some basic function like 'CryptReleaseContext' and ' __CxxFrameHandler3' automatically.

I have changed Type Libraries and it still cannot identify lots of functions,but I'm sure some of these functions exactly belongs to some libraries which is compiled into this exe statically.

// Microsoft VisualC 2-11/net runtime
void *__thiscall unknown_libname_2(void *this, char a2)
{
      void *v2; // esi@1
      v2 = this;
      sub_402CE1(this);
      if ( a2 & 1 )
          j__free(v2);
      return v2;
}

So,is there a big database of sig files about all kinds of libraries,or some way to recognize these static libraries?

edited Aug 11 '15 at 16:51

asked Aug 11 '15 at 16:36

user3836856

`__CxxFrameHandler3` is from `msvcrt.dll`, IIRC. Show an example of what you are getting and what you were expecting. – 500 - Internal Server Error Aug 11 '15 at 16:44
example has been added up there. – user3836856 Aug 11 '15 at 16:54
Right. Evidently there is a mismatch between your module and IDA Pro's RTL recognition sig db. Not sure what to do about that. – 500 - Internal Server Error Aug 11 '15 at 16:56

IDA pro cannot recognize some static compiled library in a pe file

0 Answers0