如何识别静态链接文件中的Stripped Functions？求可行替代方案

Hey there! Let's dig into solving this problem of spotting stripped functions in statically linked binaries— I totally get why IDA FLIRT might not be delivering the results you want; signature databases can be surprisingly finicky, especially if your target uses a less common compiler or custom optimizations. Here are some practical, hands-on approaches I’ve relied on in similar scenarios:

• Heuristic Analysis via Function Prolog/Epilog Patterns
  Most compilers generate consistent function start (prolog) and end (epilog) sequences based on the target architecture. For example:

  • x86: Typical prologs look like push ebp; mov ebp, esp
  • ARM: Common prologs include push {r4, lr} or stmfd sp!, {r4, lr}
    You can write simple scripts (using IDA Python or Ghidra Script) to scan the binary for these patterns and auto-mark them as function entry points. Tools like Ghidra also have built-in heuristic analyzers that often outperform FLIRT for non-standard binaries—just run its full auto-analysis and tweak the function detection settings if needed.

• Cross-Reference & Data Flow Tracing
  Stripped functions don’t have names, but they’re still called by other code or call known functions (like standard libc routines, if there’s any dynamic linking overlap). Start from known entry points (e.g., _start, main) and trace the call graph:

  • In IDA, use the "Analyze all references to selected" feature to follow calls to unknown memory regions
  • In Ghidra, use the Call Graph view to map out connections between identified and unidentified code blocks
    Any region that’s explicitly called or returns control to other code is almost certainly a function.

• Build Custom Signature Databases
  If FLIRT’s default signatures aren’t working, create your own tailored to your target’s environment:

  1. Collect unstripped binaries compiled with the same compiler, flags, and architecture as your target
  2. Use IDA’s sigmake tool to generate custom FLIRT signatures from these reference binaries
  3. Load your custom signature database into IDA and re-run the function identification
     You can also use libraries like LIEF to extract raw byte sequences of known functions and write your own matching logic for more granular control.

• Symbol Execution Tools (Angr, Binary Ninja)
  Tools like Angr use symbolic execution to map out control flow automatically, which helps it identify function boundaries even in stripped or obfuscated binaries. Load your binary into Angr, run its auto-analysis, and export the detected function entry points to your disassembler of choice. While there’s a small learning curve, this method works wonders for complex binaries where heuristic methods fall short.

A Quick Note on Ninjya Binary #

From my experience, Ninjya Binary relies on pre-built signature packs for common libraries and compiler-generated functions. To use it:

1. Load your stripped binary into the tool
2. Select the signature pack that matches your target’s architecture and compiler (e.g., GCC x86_64, ARM Clang)
3. Run the signature scan— it will rename matching stripped functions based on the database
   If you’re stuck, check the tool’s built-in help docs; they walk through the process step-by-step for most common use cases.

Combining a couple of these methods (like custom signatures + Ghidra’s heuristic analysis) usually yields the best results, especially for niche or custom-compiled binaries. Don’t hesitate to automate repetitive parts with scripts—it’ll save you hours of manual work!

内容的提问来源于stack exchange，提问作者docomoco