I am trying to get a complete list of symbol names in IDA. All functions that return names operate primarily around looking at particular addresses and there corresponding entries in the symbol table, instead of looking at all the entries of the symbol table itself.
This is okay until you have symbols that are at the same address, such as constructors and destructors for a class C1
and C2
, D1
and D2
(as described in the C++ ABI). The traditional methods get_func_name(ea)
and GetFunctionName(ea)
don't work, because they only give one result for a given address.
If multiple symbol names point to the same effective address, how can I get all of those symbol names?
Edit:
Consider the following code:
class apple{
public:
apple(int a);
~apple();
};
apple::apple(int a){}
apple::~apple(){}
int main(){
apple a = apple(1);
return 0;
}
Compiling this with g++ -o apple apple.cpp
to get our executable and then running readelf -s
gives us, among other entries:
53: 0000000000400554 11 FUNC GLOBAL DEFAULT 14 _ZN5appleD1Ev
57: 0000000000400546 14 FUNC GLOBAL DEFAULT 14 _ZN5appleC1Ei
65: 0000000000400546 14 FUNC GLOBAL DEFAULT 14 _ZN5appleC2Ei
70: 0000000000400554 11 FUNC GLOBAL DEFAULT 14 _ZN5appleD2Ev
Notice how C1
and C2
have the same address.
Now, using IDAPython, we can use idautils.Names()
(as suggested) or any of the other methods previously discussed, in code like this:
import idautils
for name in idautils.Names():
print name
and we get results looking like, among other information that's not relevant, this:
(4195654L, '_ZN5appleC2Ei')
(4195668L, '_ZN5appleD2Ev')
Notice how it only finds the C2
and D2
constructor / destructor, but not C1
and D1
. Is it possible to 'find' the C1
and D1
constructor / destructor with IDA?