开发者

IDA pro: apply signatures on unknown_libname_x functions?

When applying signatures IDA pro will name some functions unknown_libname_x. These functions reflect a library function that IDA doesn't have enough details on. Often, however, other signatures may have more information on such functions and thus when those signatures are applied after the first, I would like IDA to also apply on all unknown_libname_x functions - can this be done? As it is IDA seems to ONLY apply signatures on functions not touched by previously applied sig开发者_如何学运维natures or by you.

Frankly I do not understand why IDA doesn't do this by default - if signature y has more information than x on a specific function it seems trivial that one would like y to overrule/add to what info x provided.


You can add/remove signatures of runtime libraries through the Signatures sub-view [View->Open Subviews->Signatures).


i noticed that often IDA wrongly names a function unknown_library_xxx.

you have to inspect them yourself to determine if it really is some library fn, or really belongs to the application code.

0

上一篇:

下一篇:

精彩评论

暂无评论...
验证码 换一张
取 消

最新问答

问答排行榜