idenLib - Library Function Identification
When analyzing malware or 3rd party software, it's challenging to identify statically linked libraries and to understand what a function from the library is doing.
idenLib.exe is a tool for generating library signatures from
How does idenLib.exe generate signatures?
- Parses input file(
.objfile) to get a list of function addresses and function names.
- Gets the last opcode from each instruction
Compresses the signature with zstd
Saves the signature under the
SymExdirectory, if the input filename is
zlib.lib, the output will be
zlib.lib.sig(64)already exists under the
SymExdirectory from a previous execution or from the previous version of the library, the next execution will append different signatures. If you execute
idenLib.exeseveral times with different version of the
sig64file will include all unique function signatures.
- Generate library signatures:
idenLib.exe /path/to/pe -getmain
Generating library signatures
IDA Pro plugin usage:
IDA Pro's main directory
- Apply signatures:
main function signature:
If you want to generate a signature for
main function compiled using
MSVC 14 you need to create a
hello world application with the corresponding compiler and use the application as input for
main function signature files are
Notes Regarding to
main Function Signatures
DIA APIsto browse debug information stored in a PDB file. To run
-getmainparameter you will need to ensure that the msdia140.dll (found in
Microsoft Visual Studio\2017\Community\DIA SDK\bin) is registered as a COM component, by invoking regsvr32.exe on the dll.
There are two ways to apply signatures, exact match and using
- Detailed information about
C Run-Time Libraries (CRT)