1

I'm trying to add a dynamic import segment in the IDA database which contains functions names, and I'm applying type information to it, so that I can obtain argument locations by using apply_callee_tinfo when I found a call to this dynamic imported function.

While I'm testing I found that for some of the declarations, the argument or return type is not able to identify. The IDA is giving a numeric type.

enter image description here

The code used is

def add_from_declaration(declarations):
    dyn_imp_seg_loc = 0x10000
    dyn_imp_seg_loc_end = 0x10000 + len(declarations.keys()) * 4
    idaapi.add_segm(0, dyn_imp_seg_loc, dyn_imp_seg_loc_end, "DYN_IMP", "XTRN")
    t_loc = dyn_imp_seg_loc
    not_applied = []
    for proc_name in declarations:
        decl = str(declarations[proc_name])
        print(decl)
        try:
            name, types, fields = idc.ParseType(decl, 0)
            success = idc.MakeName(t_loc, str(proc_name))
            t = idaapi.tinfo_t()
            til = idaapi.til_t()
            t.deserialize(til, types, fields)
            if success:
                idc.MakeDword(t_loc)
                success = idaapi.apply_tinfo(t_loc, t, 1)
                if not success:
                    not_applied.append(proc_name)
        except Exception:
            continue
        finally:
            t_loc = t_loc + 4
    return not_applied

declarations is a dict with key as the function name and value as the declaration. What am I doing wrong in this?

Edit: My approach is based on the answers provided in this thread, In IDA, is there a way to add a reference to a dynamically imported function into the Imports tab?. My problem is not with adding import segment or creating cross references. But I'm unable to add type information to a name.

As you can see from the image, I'm trying to apply declaration BOOL __stdcall ReleaseMutex(HANDLE a0); at location 0x10000 which is named ReleaseMutex, but IDA is not able to identify BOOL and HANDLE structures even after parsing the declaration successfully.

0

0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.