4

IDA allows one to rename a program entity (e.g. register, variable, function) using N shortcut. Is it possible to get a list of such user-defined names in IDA?

| improve this question | |
  • Do you mean hex-rays variables by "variables" ? If yes, this script dumps almost all user defined things in specific decompiler function: github.com/idapython/src/blob/master/examples/vds4.py – w s Nov 1 '16 at 8:13
  • 1
    In addition idautils.Names() can be used to retrieve the named global entities. – w s Nov 1 '16 at 8:17
5

The idautils.Names function might be of interest to you, as it returns a list of (ea, name) tuples for all names defined in the IDB and the ea at which they're located.

Additionally, you can use the answer to the question Igor linked (Get a list of global variables with IDA python) to get a list of all functions.

Once you have the eas you can do the following to figure out if a function or ea was named by the user:

def is_user_name(ea):
  f = idc.GetFlags(ea)
  return idc.hasUserName(f)

This function will return true if an EA has a name set by the user either programatically or manually.

| improve this answer | |
  • 1
    I think the Names utility function is available under idautils, not idc. – Willi Ballenthin Jul 27 '17 at 15:32
  • the API name is idc.GetNames, not idc.getNames. I can't make the edit because its less than six chars difference. – Willi Ballenthin Sep 22 '17 at 17:49
  • @WilliBallenthin Couldn't find a reference to idc.getnames anywhere in my comment. Let me know and I'll edit. – NirIzr Sep 22 '17 at 17:51
  • 1
    whoops, i'm sorry! I meant idc.GetFlags(). – Willi Ballenthin Sep 24 '17 at 0:53
  • is_user_name seems to return True even for library names that were generated during analysis. – dkaranovich Aug 12 '19 at 4:30
2

You can use View->Open subview->Names or Shift-F4. Note that the list included all names, both user-defined as well as generated by IDA (e.g. ASCII string names).

See also related Get a list of global variables with IDA python

| improve this answer | |
  • 1
    Is it possible to list out user-defined names only, not IDA generated ones? – Holmes.Sherlock Nov 1 '16 at 18:42
1

Run this .idc script to export all user-defined functions name. Script tested on IDA 7.0.

For IDA < 7.0: please use function hasUserName(addr) instead of has_user_name(addr)

#include <idc.idc>
static FuncDump(start)
{
    auto ea, str, count, ref;
    auto end;
    auto teststr;

    ea = start;

    while( ea != BADADDR )
    {
        str = GetFunctionName(ea);
        if( str != 0 )
        {
            end = FindFuncEnd(ea);

            count = 0;
            ref = RfirstB(ea);
            while(ref != BADADDR)
            {
                count = count + 1;
                ref = RnextB(ea, ref);
            }

            teststr = sprintf("sub_%X", ea);
            if(has_user_name(GetFlags(ea)) && !((GetFunctionFlags(ea) & FUNC_LIB) == FUNC_LIB) && teststr != str ) {
                Message("-s 0x%X=%s\n", ea, str );
            }
            //Message("%s, 0x%d, 0x%x, 0x%x, 0x%x, %d\n", str, count, ea, end, end-ea, end-ea   );
        }

        ea = NextFunction(ea);
    }
}

static main() 
{
    Message("FuncDump: Start\n");

    FuncDump(0x40000);

    Message("FuncDump: Done\n");
}
| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.