7

I have a text file which contains a list of function name and address pairs, structured like this :

194C:841B LoadMessage
194C:8429 ShowDialog
...

Is there a way (eg: script, automation, ...) to automatically rename all relation functions of the IDA disassembly according the text file ?

2
  • What does this form of address mean ?
    – w s
    Jan 28, 2016 at 13:15
  • This is a segmented address from an old DOS 16 bit program. See here : en.wikipedia.org/wiki/X86_memory_segmentation We can consider it contains 32 bit regular addresses if it make it easier.
    – tigrou
    Jan 28, 2016 at 13:30

1 Answer 1

5

This way to automate things called IDAPython, its documentation is here:

1 - Save this script somewhere, remember where.

#Not used, not debbugged, not ran even once
#Use on your own risk, beware errors

import idaapi
import idautils
import idc

def do_rename(l):
    splitted = l.split()
    straddr = splitted[0]
    strname = splitted[1].replace("\r", "").replace("\n", "")

    if straddr.find(":") != -1: #assuming form segment:offset
        #removing segment, offset should be unique, if it isn't so, we should handle it differently
        straddr = straddr.split(":")[1]

    eaaddr = int(straddr, 16)
    idc.MakeCode(eaaddr)
    idc.MakeFunction(eaaddr)
    idc.MakeNameEx(int(straddr, 16), strname, idc.SN_NOWARN)


if __name__ == "__main__":
    f = open( "your_file_name", "r")
    for l in f:
        do_rename(l)
    f.close()

In IDA, open File-->Script file, chose the script and run it. Note that you should insert your file name and verify that the address is converted well.

Hope it gives some kind of direction.

2
  • Keep me posted :)
    – w s
    Jan 28, 2016 at 14:13
  • 1
    It worked like a charm. The only change i made was in the way the linear address is calculated : eaaddr = int(address[0], 16) * 16 + int(address[1], 16) + offset. Offset is calculated from a C function that IDA was able to find itself and for which i know the address : offset = LocByName("_system") - 0x189B
    – tigrou
    Jan 28, 2016 at 15:38

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.