How to distinguish user / library functions from a compiled file?

Question

EDIT

I want to highlight statically linked library functions and user self-tuning functions inside a compiled file (like a PE file).

How to do it? (I am thinking about comparing a database, but I do not know any database.)

By the way, (I already knew long before I asked this question) for dynamically linked library functions, this is just an entry in the import table (PE).

---

By library functions, I mean those that are defined in libraries such as STL (I know this is a bad name).

By user functions, I mean those written by individual programmers.

Is there any software way to achieve this?

Now I am thinking about comparing binaries with a database, but so far I do not know any databases.

Please recommend a database or otherwise as an answer. Thanks.

Answer 1

This answer assumes that you want to parse a standard Windows executable that is dynamically linked to other import libraries (.lib and assoicated.dll files that are not statically linked), and if so, you want PE (Portable Executable).

Here's a good article to get you started, with sample code for resetting the PE header.

You want to focus on the import table (.idata section) for external library calls and the export table (.edata section) for calls defined inside the executable and marked as exportable (this usually only exists in .dll files).

For static libraries, their format is called COFF, and there is the DUMPBIN utility that comes with Visual Studio, which you can use to quickly map to your lib files and even reset code parsing if you want.

The DUMPBIN utility, which is provided with the 32-bit version of Microsoft Visual C ++, combines LINK, LIB, and EXEHDR utilities. The combination of these tools shows the ability to provide information about the format and characters represented in executable, library and DLL files.

For information on the structure of COFF files, see.

Finding out if a function call was called from the lib library or not, but because I remember, most of the static lib calls in the code are actually thunk calls (simple jmp calls for the actual object code copied from lib) and are small in size size (usually around 5 bytes), while user-defined are not thunks and are based on bp frame calls.

Answer 2

When your program is connected, static functions and user-defined functions include a file by file.

So, if you give the header of the PE file and look at the table characters (using objdump -x, if you run using mingw32 or something else) you will see the file name, and then import all the functions from this, after another file name and it functions ...
Or, if you have debugging information, maybe it could be easier.

So, after you associate the functions with the file, you can sort the functions by analyzing their file name. Look for the extension (.c / .lib / .a) or check the list of files that you have. Be careful to delete crt0 files ...

However, this is a rather complicated decision, and I'm not sure if this will work for every program.