The library function recognition algorithm of PE file disassembler research and implementation

摘要

In order to solve the problem of static library function recognition of Windows PE (Portable Execute) in the field of software reverse engineering, a new extraction algorithm based on the library function signature is presented. The algorithm extracts the library function signature of lib suffix to the files, then the disassembler identifies the functions with the library function signature and return the address and the corresponding library function name in the disassembly phase of PE files. The results show that the recognition algorithm is able to efficiently identify the library function address, and library function blocks.