|
IDA finds library functions by signature (mask of bytes from function's entrypoint) and yes, it is possible, that IDA can give "false positive". Also, there are many different realizations of standard functions (i.e. 10-ths variants of optimized memcpy/memset/etc.), which can be mixed in output code compiled with different optimization options for example, so you can have different code for the same function in your file.
|