IdaPro/HexRays type libraries

Question

I'm trying to improve my use of ida/hexrays... I have a x86 linux elf binary, non-stripped, statically linked w/ openssl. So you can see all of the OpenSSL function names in the binary.

I used the tilib cli tool to make a type library from the bio.h header. It looks like it worked and the .til has a bunch of struct and function definitions. I copied it over and added it in ida in the "type libraries" dialog. I know it got stuff cause I retyped a parameter in a function in hexrays from int to BIO* and it fixed up all of the references to the struct members.

But it's not fixing up function prototypes. e.g. BIO_puts is still (int,int) even though the til has it as (BIO *bp, const char *buf).

Am I doing something wrong, or am I expecting too much out of hexrays/ida? thanks in advance!

Answer 1

IDA's til files are basically IDA's way of storing type information for particular functions. AFAIK, a .til file doesn't tell IDA how to actually recognize that function in order to apply function prototype information. For that piece you're going to need produce the requisite .sig file using IDA's Flirt utilities.

By default, IDA won't replace existing type information unless it was "auto-generated" upon initial analysis; so you've got to reset the type field for IDA to fill in the type info. Since the names were already present, it wouldn't count as "auto-generated" to IDA (i.e. sub_XXXX).

That being said, you should still be able to make use of the .til file you produced. Go to one of the OpenSSL functions, and put your cursor on the name. Press Y. This will bring up your type declaration. Clear the field, and hit ok. Then press N, make sure the name is exactly as it's spelled in the header/.til file, and then press enter. It should then populate the correct type information.

Obviously, this is a pain for an entire library. I'm assuming that all the OpenSSL functions are in the same area. So if you know the start and end address you can do something like this to fix it all up (assuming the names already match your header file):

for func_ea in Functions(openssl_start_ea, openssl_end_ea):
    func_name = GetFunctionName(func_ea) #Get Current Name
    SetType(func_ea, "") #Reset Type Info
    MakeName(func_ea, func_name) #Recreate Name to get new type info