0

I'm currently reversing some C++ Binary (macOS Kernel Extension).
But, there are a lot of vtable functions, so i want to make some vtable structures by using IDAPython.

I know how to make structure itself, but i don't know how to get symbol in following case.

UNDEF:0000000000003E60 ; IORegistryEntry::compareName(OSString *, OSString **)const
UNDEF:0000000000003E60                 extrn __ZNK15IORegistryEntry11compareNameEP8OSStringPS1_:qword
UNDEF:0000000000003E60                                         ; DATA XREF: __const:0000000000002410↑o
UNDEF:0000000000003E60                                         ; __const:0000000000002F40↑o
UNDEF:0000000000003E68 ; IORegistryEntry::getLocation(IORegistryPlane const*)const
UNDEF:0000000000003E68                 extrn __ZNK15IORegistryEntry11getLocationEPK15IORegistryPlane:qword
UNDEF:0000000000003E68                                         ; DATA XREF: __const:0000000000002428↑o
UNDEF:0000000000003E68                                         ; __const:0000000000002F58↑o
UNDEF:0000000000003E70 ; IORegistryEntry::getProperty(OSString const*)const
UNDEF:0000000000003E70                 extrn __ZNK15IORegistryEntry11getPropertyEPK8OSString:qword
UNDEF:0000000000003E70                                         ; DATA XREF: __const:0000000000002320↑o
UNDEF:0000000000003E70                                         ; __const:0000000000002E50↑o
UNDEF:0000000000003E78 ; IORegistryEntry::getProperty(OSString const*, IORegistryPlane const*, unsigned int)const
UNDEF:0000000000003E78                 extrn __ZNK15IORegistryEntry11getPropertyEPK8OSStringPK15IORegistryPlanej:qword
UNDEF:0000000000003E78                                         ; DATA XREF: __const:0000000000002338↑o
UNDEF:0000000000003E78                                         ; __const:0000000000002E68↑o
UNDEF:0000000000003E80 ; IORegistryEntry::getProperty(OSSymbol const*)const
UNDEF:0000000000003E80                 extrn __ZNK15IORegistryEntry11getPropertyEPK8OSSymbol:qword
UNDEF:0000000000003E80                                         ; DATA XREF: __const:0000000000002318↑o
UNDEF:0000000000003E80                                         ; __const:0000000000002E48↑o
UNDEF:0000000000003E88 ; IORegistryEntry::getProperty(OSSymbol const*, IORegistryPlane const*, unsigned int)const
UNDEF:0000000000003E88                 extrn __ZNK15IORegistryEntry11getPropertyEPK8OSSymbolPK15IORegistryPlanej:qword
UNDEF:0000000000003E88                                         ; DATA XREF: __const:0000000000002330↑o
UNDEF:0000000000003E88                                         ; __const:0000000000002E60↑o
UNDEF:0000000000003E90 ; IORegistryEntry::getProperty(char const*)const
UNDEF:0000000000003E90                 extrn __ZNK15IORegistryEntry11getPropertyEPKc:qword
UNDEF:0000000000003E90                                         ; DATA XREF: __const:0000000000002328↑o
UNDEF:0000000000003E90                                         ; __const:0000000000002E58↑o

...

I want to get above symbol name.
I tried to use idc.GetFunctionName and idautils.Functions(), i can't get symbol name fully. Result is below.

Python>import idautils
Python>for func in idautils.Functions():
Python>  print(hex(func), idc.GetFunctionName(func))

...

('0x3950L', '__ZN15OSMetaClassBase12safeMetaCastEPKS_PK11OSMetaClass')
('0x3a08L', '__ZN8OSObjectdlEPvm')
('0x3a10L', '__ZN8OSObjectnwEm')
('0x3e00L', '__ZN9IOServiceC2EPK11OSMetaClass')
('0x3e08L', '__ZN9IOServiceD2Ev')
('0x3e38L', '__ZNK11OSMetaClass19instanceConstructedEv')
('0x3fb0L', '__ZNK9IOService10isInactiveEv')

Is there some good way to get symbols?

3

These names are mangled. You need to demangle it back.

1 - Read something about name mangling in order to understand why clear IORegistryEntry::getProperty(OSString const*)const is converted to __ZNK15IORegistryEntry11getPropertyEPK8OSString .

2 - Use demangling in IDA python (idc.demangle_name or ida_name.demangle_name).

3 - If something goes wrong, you can go to online demangler.

It converts your

('0x3950L', '__ZN15OSMetaClassBase12safeMetaCastEPKS_PK11OSMetaClass') ('0x3a08L', '__ZN8OSObjectdlEPvm') ('0x3a10L', '__ZN8OSObjectnwEm') ('0x3e00L', '__ZN9IOServiceC2EPK11OSMetaClass') ('0x3e08L', '__ZN9IOServiceD2Ev') ('0x3e38L', '__ZNK11OSMetaClass19instanceConstructedEv') ('0x3fb0L', '__ZNK9IOService10isInactiveEv')

to

('0x3950L', '_OSMetaClassBase::safeMetaCast(OSMetaClassBase const*, OSMetaClass const*)')
('0x3a08L', '_OSObject::operator delete(void*, unsigned long)')
('0x3a10L', '_OSObject::operator new(unsigned long)')
('0x3e00L', '_IOService::IOService(OSMetaClass const*)')
('0x3e08L', '_IOService::~IOService()')
('0x3e38L', '_OSMetaClass::instanceConstructed() const')
('0x3fb0L', '_IOService::isInactive() const')

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.