Stuck on an issue?
Lightrun Answers was designed to reduce the constant googling that comes with debugging 3rd party libraries. It collects links to all the places you might be looking at while hunting down a tough bug.
And, if you’re still stuck at the end, we’re happy to hop on a call to see how we can help out.
[Enhancement] Don't include library functions, identified by `IDA`, in decoding functions
See original GitHub issueCurrently, floss depends on https://github.com/mandiant/flare-floss/tree/master/sigs to determine the library functions, but in some cases floss includes library functions (identified by IDA FLIRT) in decoding functions. So, can we leverage the IDA FLIRT to exclude them or I think sigs need some update.
Issue Analytics
- State:
- Created a year ago
- Comments:19 (9 by maintainers)
Top Results From Across the Web
Why does IDA not show certain library functions in the ...
First, some background. When a binary imports an API function, the operating system loader stores a function pointer to that function in a ......
Read more >Issues · mandiant/flare-floss
Document IDA and other tool script generation ... exclude/tag strings referenced by library functions (identified by FLIRT) enhancement.
Read more >Annotating Malware Disassembly Functions Using Neural ...
Malware analysts and reverse engineers will skim through functions using a disassembler, such as NSA's Ghidra or Hex-Rays' IDA Pro, which ...
Read more >Using IDAPython to Make Your Life Easier: Part 2
The first step actually does not use IDAPython whatsoever, but it does use Python. In order to identify what hashes equate to what...
Read more >
Top Related Medium Post
No results found
Top Related StackOverflow Question
No results found
Troubleshoot Live Code
Lightrun enables developers to add logs, metrics and snapshots to live code - no restarts or redeploys required.
Start Free
Top Related Reddit Thread
No results found
Top Related Hackernoon Post
No results found
Top Related Tweet
No results found
Top Related Dev.to Post
No results found
Top Related Hashnode Post
No results found
Ah, now I understand. That’s a bug I’ll fix shortly! Thank you.
My answers (i.e. the matching part) is referring to your comment. I’d like to investigate the concern if there’s more need for it besides wrapper function differences (as this is what I’ve seen so far only).