IDA allows one to rename a program entity (e.g. register, variable, function) using N
shortcut. Is it possible to get a list of such user-defined names in IDA?
-
Do you mean hex-rays variables by "variables" ? If yes, this script dumps almost all user defined things in specific decompiler function: github.com/idapython/src/blob/master/examples/vds4.py– w sNov 1, 2016 at 8:13
-
1In addition idautils.Names() can be used to retrieve the named global entities.– w sNov 1, 2016 at 8:17
3 Answers
The idautils.Names
function might be of interest to you, as it returns a list of (ea, name)
tuples for all names defined in the IDB and the ea at which they're located.
Additionally, you can use the answer to the question Igor linked (Get a list of global variables with IDA python) to get a list of all functions.
Once you have the ea
s you can do the following to figure out if a function or ea was named by the user:
def is_user_name(ea):
f = idc.GetFlags(ea)
return idc.hasUserName(f)
This function will return true if an EA has a name set by the user either programatically or manually.
-
1I think the
Names
utility function is available underidautils
, notidc
. Jul 27, 2017 at 15:32 -
the API name is
idc.GetNames
, notidc.getNames
. I can't make the edit because its less than six chars difference. Sep 22, 2017 at 17:49 -
@WilliBallenthin Couldn't find a reference to idc.getnames anywhere in my comment. Let me know and I'll edit.– NirIzrSep 22, 2017 at 17:51
-
1
-
is_user_name
seems to returnTrue
even for library names that were generated during analysis. Aug 12, 2019 at 4:30
You can use View->Open subview->Names or Shift-F4. Note that the list included all names, both user-defined as well as generated by IDA (e.g. ASCII string names).
See also related Get a list of global variables with IDA python
-
1Is it possible to list out user-defined names only, not IDA generated ones? Nov 1, 2016 at 18:42
Run this .idc script to export all user-defined functions name. Script tested on IDA 7.0.
For IDA < 7.0: please use function hasUserName(addr) instead of has_user_name(addr)
#include <idc.idc>
static FuncDump(start)
{
auto ea, str, count, ref;
auto end;
auto teststr;
ea = start;
while( ea != BADADDR )
{
str = GetFunctionName(ea);
if( str != 0 )
{
end = FindFuncEnd(ea);
count = 0;
ref = RfirstB(ea);
while(ref != BADADDR)
{
count = count + 1;
ref = RnextB(ea, ref);
}
teststr = sprintf("sub_%X", ea);
if(has_user_name(GetFlags(ea)) && !((GetFunctionFlags(ea) & FUNC_LIB) == FUNC_LIB) && teststr != str ) {
Message("-s 0x%X=%s\n", ea, str );
}
//Message("%s, 0x%d, 0x%x, 0x%x, 0x%x, %d\n", str, count, ea, end, end-ea, end-ea );
}
ea = NextFunction(ea);
}
}
static main()
{
Message("FuncDump: Start\n");
FuncDump(0x40000);
Message("FuncDump: Done\n");
}