0

Iv'e never used python before and in looking at other example I can't find what I'm looking for exactly so I have come here to humbly ask for an example script if anyone could be so kind, I am trying to simply make a table of function names and their corresponding sig and then I'd like to run the script in ida and have it search for the aob and if found rename that function to the sigs name and if not found just print that it wasn't found. I have coded in lua an exact replica of what I am trying to accomplish. Thanks for your time!

local sigs = {
    ["func1"] = "ff ff ff ff ff ff ff",
    ["func2"] = "ff ff ff ff ff ff ff",
    ["func3"] = "ff ff ff ff ff ff ff",
    ["func4"] = "ff ff ff ff ff ff ff"
}

for name, sig in pairs(sigs) do
    local address = searchaob(sig)
    if address then
        rename(address, name)
    else
        print(name .. " not found")
    end
end
2
  • Do I understand correctly that by aob you mean array of bytes and by sig you mean some specific array of bytes that should identify a function ?
    – w s
    Commented Jun 19, 2019 at 8:23
  • @w s yes sir that is correct.
    – Icesythe7
    Commented Jun 19, 2019 at 13:40

1 Answer 1

2

You can do it pretty easily with find_binary and set_name, just a matter of iterating over your patterns and searching for them. IDA supports wildcards in binary patterns too.

This should give you a good idea on how to do it:

patterns = {
    "fn1": "AA BB CC DD EE ? ? ?",
    "fn2": "BB CC DD EE FF ? ? ? AA",
    ...
}

for name, pattern in patterns.items():
    ea = idc.find_binary(0, ida_search.SEARCH_DOWN, pattern)

    if ea == ida_idaapi.BADADDR:
        # not found
        break

    idc.set_name(ea, name)

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.