3

Let's say I have:

mov ecx, [g_pMyClassObj] ; type CMyClass
call sub_B00BA ; a thiscall function

Is there a feature/plugin/script to automatically rename all subroutine occurrences to:

mov ecx, [g_pMyClassObj] ; type CMyClass
call CMyClass__B00BA
2
  • Which Ida version are you using? Do you have HexRays decompiler?
    – w s
    Commented Aug 2, 2022 at 14:27
  • I am using IDA version 7.7, And yes I have HexRays Decompiler and use it. Commented Aug 2, 2022 at 15:34

1 Answer 1

2

As far as IDA is concerned it's programmable in almost every manner thanks to the scripting engine. When it comes to renaming a subroutine in IDA it can be achieved either using idc scripts or by using idapython.

Although renaming class methods in IDA automatically can be a tough task because you have to provide much more information to IDA such as object-name, calling conventions etc. However, a more general occurrence of a subroutine can easily be renamed using idc script.

I have provided a script below which can solve this problem. Although it can be modified to extract the subroutine offset B00BA from sub_B00BA and rename (or rather append) to a name of your liking, but I left that approach so that this script can more flexible (i.e you can change to any name and not just SomeSubName_Offset).

idc script: rename_method.idc

#include <idc.idc>

static main(void)
{
    auto ea, fncname, fstatus=-1;
    auto findsub="sub_B00BA";           // [1] Subroutine to find
    auto newsubName="CMyClass__B00BA" ; // [2] New name for the subroutine 
    for (ea=MinEA(); ea != BADADDR; ea=NextFunction(ea))
    {
        fncname = GetFunctionName(ea);                
        if (fncname == findsub) 
        {
            auto errcode = MakeNameEx(ea, newsubName, SN_PUBLIC|SN_CHECK|SN_NOWARN);
            if (errcode)
            {
                Refresh();
                RefreshLists();
                Message("[*] disassembly/subroutine-list refreshed..ok\n");
            }
            fstatus=1;
            return;
        }
    }
        if (fstatus == -1)  // if we don't have such function in disassembly
        {
            Message("[*] subroutine:" + findsub +
            " not found.\nplease check name of the subroutine/method again.\n");
        }
}

Please make sure you change subroutine name at [1] and [2]. I have tested this script using IDA 6.6 and it will definitely work with IDA 7.x.

2
  • 2
    This is one piece of the puzzle. Thank you for your contribution! Commented Aug 2, 2022 at 15:38
  • You don't need to loop over every function comparing its name against the one you want. You can use get_name_ea instead. (In earlier versions of IDA like 6.6, it was known as LocByName.) Commented Sep 1, 2022 at 19:49

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.