1

I have three files:

  1. ELF executable,
  2. ELF dynamically linked library (.so),
  3. C headers file (.h) with function signatures and related structures for that library.

#1 imports a number of functions from #2.

Is there a way for me to leverage #3 to automatically apply signatures from #3 to:

  1. Imports in #1 in one instance of IDA?
  2. Exports in #2 in another instance of IDA?
1

There are several functions in the SDK, in typeinf.hpp or ida_typeinf.py that could be of use here, with the python API being much easier to use.

  • parse_decls - for converting a header file to a til_t type library.
    • this function seems to skip plain function declarations.
    • but does store typedefs by name.
  • parse_decl - for converting a single declaration to a tinfo_t object.
    • this does work for function declarations, but loses the function name.
  • get_named_type - for looking up a type in the til_t.
  • apply_type - for applying a type to a function.

So you could either parse the name from the function declaration yourself, and then use parse_decl to parse each declaration seperately.

Or you could add typedef to the start of each declaration, so ida will store all your declarations, by name in a type libary.

0

Try using File -> Load File -> Parse C Header File (Ctrl+F9). You might need to tweak some things in the header file.

  • Thank you for your response. I have tried this and it did not work. IDA successfully parses the file. I can manually fix function signatures by telling IDA what the arguments are, including custom structure pointers. However, this is very time consuming and feels unnecessary. Is there a way for it to automatically or semi-automatically apply signatures from the header file to functions matched by name? – pandasauce Jun 28 '17 at 11:23
  • Yes. that way is the feature described above. It does not parse complicated C constructs and as mentioned you may need to tweak the file to make it usable by IDA. You can write a script to do that. – NirIzr Jun 28 '17 at 14:52
  • I managed to get first scenario to work using tilib. What changes would I need to make to the header file to get the second scenario to work, i.e. apply function signatures to the library file? – pandasauce Jun 28 '17 at 16:09

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.