Get Multiple Function Names for One Address in IDA

Question

I am trying to get a complete list of symbol names in IDA. All functions that return names operate primarily around looking at particular addresses and there corresponding entries in the symbol table, instead of looking at all the entries of the symbol table itself.

This is okay until you have symbols that are at the same address, such as constructors and destructors for a class C1 and C2, D1 and D2 (as described in the C++ ABI). The traditional methods get_func_name(ea) and GetFunctionName(ea) don't work, because they only give one result for a given address.

If multiple symbol names point to the same effective address, how can I get all of those symbol names?

Edit:

Consider the following code:

class apple{
    public:
        apple(int a);
        ~apple();
};

apple::apple(int a){}
apple::~apple(){}

int main(){
    apple a = apple(1);
    return 0;
}

Compiling this with g++ -o apple apple.cpp to get our executable and then running readelf -s gives us, among other entries:

53: 0000000000400554    11 FUNC    GLOBAL DEFAULT   14 _ZN5appleD1Ev
57: 0000000000400546    14 FUNC    GLOBAL DEFAULT   14 _ZN5appleC1Ei
65: 0000000000400546    14 FUNC    GLOBAL DEFAULT   14 _ZN5appleC2Ei
70: 0000000000400554    11 FUNC    GLOBAL DEFAULT   14 _ZN5appleD2Ev

Notice how C1 and C2 have the same address.

Now, using IDAPython, we can use idautils.Names() (as suggested) or any of the other methods previously discussed, in code like this:

import idautils
for name in idautils.Names():
    print name

and we get results looking like, among other information that's not relevant, this:

(4195654L, '_ZN5appleC2Ei')
(4195668L, '_ZN5appleD2Ev')

Notice how it only finds the C2 and D2 constructor / destructor, but not C1 and D1. Is it possible to 'find' the C1 and D1 constructor / destructor with IDA?

Answer 1

IDA, while loading ELF file, will choose only one name and use if for specific address, because there's no way for IDA to have multiple names for on address. So you'll have to invent something to extend IDA loader for elf files, to make it somehow store the alternative names for the address.

Answer 2

Maybe going the other way might be a workaround/solution?

You can enumerate all names with idautils.Names() which returns a list of tuples (ea, name). Then you just filter for the function address and have all possible names for that location I assume.