Give a name to an arbitrary hex value in IDA Pro

Question

I'm using IDA Pro 7.0.

I am analyzing a library that is part of a larger ARM executable, so there are often calls to external functions that aren't in this library. Therefore obviously the address of the call does not get symbolicated correctly. For example, the program might be calling mmap, which is at 0x12345678a , but it shows up as

BL              0x12345678a

instead of

BL              _mmap

I have a text file that lists all the external functions and their addresses; i.e., one of the lines of this file is

12345678a _mmap

So I want to write a script to rename the locations in IDA based on this external file.

Can anyone tell me what the IDC or IdaPython command would be to associate the address 0x12345678a with the name _mmap so that these calls show up correctly in the disassembly?

Something like MakeName(0x12345678a, '_mmap') doesn't work, because 0x12345678a doesn't exist in any segment of the library I'm inspecting. Also, I would prefer them not to show up in the names list if possible.

Answer 1

You can't rename the locations, because by your own admission, they don't exist. In this case, if you're not worried about maintaing control flow information and just want to see the name that corresponds to the address, you can do a couple of things.

Inline Comments

You can write an IDAPython script to:

1. Parse your text file
2. Locate all of the unresolved BL calls, extract the address
3. Look up the name in your parsed symbol information
4. Create a comment in the database with the symbol name using the idc.MakeComm(ea, symbol_name) function

This will get you an inline comment with the symbol name, something like this:

BL 0x12345678a  # _memmap

Make an Enum from the Symbol Info

If you wanted to change the representation of the raw address to a string, you can create an enum out of the data in the text file, and then apply that enum to the operand of all the BL instructions that have unresolved targets. This should effectively give you a name for that call target, even though the address doesn't exist in the database, like so:

BL _memmap

You can accomplish this a couple of ways: by using the IDAPython enum functions (AddEnum/AddConstEx), assuming you have processed your text file into a list of tuples of (symbol, addr):

id = idc.AddEnum(index, "MyEnum", flags)
for symbol, addr in text_info:
    idc.AddConstEx(id, symbol, value, bmask)

You can then use the idc.OpEnumEx() function wherever you have a raw address in your BL instruction to set that operand to your enum type.

You can also convert your text information file into a C header file with a single enum representing your mapping, but this is a bit more tedious.

Be warned, this is only cosmetic. Attempting to utilize any of the xref capabilities will fail, because it's not actually an address in the database, just a symbolic representation of the immediate value.

Conclusion

Both of the previously described methods will get you the information you want without adding items to the Names list.

If you wanted to maintain control flow information and get them to "show up correctly in the disassembly", you would have to create plt/got segments to simulate the rest of your address space. It's a bit more complicated, but doable if you need to do more complex analysis or want to take advantage of IDA's library recognition and type propagation. Sounds like you just need the visual assistance of the symbol name, though. Hope this helps.