2

I have a long list of mappings from IDA function names (sub_??????) to known function prototypes. The prototype is complete, I mean it contains the return type, the name as in the code and the argument types and names.

My question is, how can I batch rename and overwrite all the data about the functions with this prototype information using an IDAPython script?

  • 1
    Sometimes IDA can't detect function parameters from stack (like __fastcall). So you have to determine the numbers of prameters. – Biswapriyo Aug 23 '18 at 3:34
2

IDA has the idc.SetType method that would accept a function start offset and a function prototype string and will set that function's prototype, although it will not set the function's name.

The idc.SetType function is actually a convenience function around ida_typeinf.idc_parse_decl and ida_typeinf.apply_type, through a couple of other methods defined in the idc module. If you wanna set both function name and prototype, you could use idc.parse_decl to parse the prototype and then call idc.apply_type and idc.set_name to set the prototype and name.

Reading the code I linked to around idc.SetType really makes the API clear.

An example code could look something like this:

prototype_details = idc.parse_decl(PROTOTYPE, idc.PT_SILENT)
if prototype_details:
    idc.set_name(FUNCTION_ADDRESS, prototype_details[0])
    idc.apply_type(FUNCTION_ADDRESS, prototype_details)

Naturally, you'll need to replace PROTOTYPE and FUNCTION_ADDRESS with the function's prototype and address, as well as implement this inside a loop. I'll leave this an an exercise for the reader.

  • 2
    This is probably not enough. All types used in function prototypes (structure pointers, for example) should be imported too, either with import header file or by creating corresponding structures, otherwise setting prototype will fail. – w s Aug 23 '18 at 14:45
  • 1
    Yes. Of course. I didn't address auxiliary structures because OP didn't mention any but you're obviously right. – NirIzr Aug 23 '18 at 14:51

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.