6

I have a text file which contains a list of function name and address pairs, structured like this :

194C:841B LoadMessage
194C:8429 ShowDialog
...

Is there a way (eg: script, automation, ...) to automatically rename all relation functions of the IDA disassembly according the text file ?

  • What does this form of address mean ? – w s Jan 28 '16 at 13:15
  • This is a segmented address from an old DOS 16 bit program. See here : en.wikipedia.org/wiki/X86_memory_segmentation We can consider it contains 32 bit regular addresses if it make it easier. – tigrou Jan 28 '16 at 13:30
5

This way to automate things called IDAPython, its documentation is here:

1 - Save this script somewhere, remember where.

#Not used, not debbugged, not ran even once
#Use on your own risk, beware errors

import idaapi
import idautils
import idc

def do_rename(l):
    splitted = l.split()
    straddr = splitted[0]
    strname = splitted[1].replace("\r", "").replace("\n", "")

    if straddr.find(":") != -1: #assuming form segment:offset
        #removing segment, offset should be unique, if it isn't so, we should handle it differently
        straddr = straddr.split(":")[1]

    eaaddr = int(straddr, 16)
    idc.MakeCode(eaaddr)
    idc.MakeFunction(eaaddr)
    idc.MakeNameEx(int(straddr, 16), strname, idc.SN_NOWARN)


if __name__ == "__main__":
    f = open( "your_file_name", "r")
    for l in f:
        do_rename(l)
    f.close()

In IDA, open File-->Script file, chose the script and run it. Note that you should insert your file name and verify that the address is converted well.

Hope it gives some kind of direction.

  • Keep me posted :) – w s Jan 28 '16 at 14:13
  • 1
    It worked like a charm. The only change i made was in the way the linear address is calculated : eaaddr = int(address[0], 16) * 16 + int(address[1], 16) + offset. Offset is calculated from a C function that IDA was able to find itself and for which i know the address : offset = LocByName("_system") - 0x189B – tigrou Jan 28 '16 at 15:38

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.