1

I'm trying to add a dynamic import segment in the IDA database which contains functions names, and I'm applying type information to it, so that I can obtain argument locations by using apply_callee_tinfo when I found a call to this dynamic imported function.

While I'm testing I found that for some of the declarations, the argument or return type is not able to identify. The IDA is giving a numeric type.

enter image description here

The code used is

def add_from_declaration(declarations):
    dyn_imp_seg_loc = 0x10000
    dyn_imp_seg_loc_end = 0x10000 + len(declarations.keys()) * 4
    idaapi.add_segm(0, dyn_imp_seg_loc, dyn_imp_seg_loc_end, "DYN_IMP", "XTRN")
    t_loc = dyn_imp_seg_loc
    not_applied = []
    for proc_name in declarations:
        decl = str(declarations[proc_name])
        print(decl)
        try:
            name, types, fields = idc.ParseType(decl, 0)
            success = idc.MakeName(t_loc, str(proc_name))
            t = idaapi.tinfo_t()
            til = idaapi.til_t()
            t.deserialize(til, types, fields)
            if success:
                idc.MakeDword(t_loc)
                success = idaapi.apply_tinfo(t_loc, t, 1)
                if not success:
                    not_applied.append(proc_name)
        except Exception:
            continue
        finally:
            t_loc = t_loc + 4
    return not_applied

declarations is a dict with key as the function name and value as the declaration. What am I doing wrong in this?

Edit: My approach is based on the answers provided in this thread, In IDA, is there a way to add a reference to a dynamically imported function into the Imports tab?. My problem is not with adding import segment or creating cross references. But I'm unable to add type information to a name.

As you can see from the image, I'm trying to apply declaration BOOL __stdcall ReleaseMutex(HANDLE a0); at location 0x10000 which is named ReleaseMutex, but IDA is not able to identify BOOL and HANDLE structures even after parsing the declaration successfully.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.