Skip to main content

26. Identifying Function Boundaries in Stripped Binaries

Stripped binaries lack function names and debugging information, making control-flow inference essential. When automatic analysis in Ghidra or IDA becomes unreliable, the following routine helps establish the outline quickly.

1) Work Backward from the Entry Point Through the Call Graph​

  • If main is not identified, trace the argument passed to __libc_start_main from _start
  • Work backward through the call graph from distinctive APIs for I/O, networking, or cryptography

2) Use Strings and Constants as Anchors​

  • Find URLs, format strings, and error messages with strings, then follow their XREFs backward
  • Magic numbers such as 0x9E3779B9 and 0x1B873593 can hint at hashing or cryptographic algorithms

3) Redefine Function Boundaries​

  • If prologue patterns are broken, adjust the range using stack frames and ret locations
  • With heavy inlining, name individual functional blocks and expand outward

4) Reinforce with Dynamic Analysis​

  • Log branch conditions and argument values with Frida or LLDB to validate static-analysis hypotheses

Even without symbols, the "anchor → expand around it → validate dynamically" workflow is enough to interpret a binary.