0

For example, in the Registers windows of IDA pro, It show the following.
( I think "WS2_32.dll:ws2_32_shutdown" is a string that IDA automatically resolved.)

EAX 766D32B0 WS2_32.dll:ws2_32_shutdown

So, would you please tell me how to get the function name string (such as WS2_32.dll:ws2_32_shutdown) from the Address (such as 766D32B0) by IDAPython ?

I try to do the following, but it don’t show the function name string..

eax_adddress = idc.get_reg_value("EAX")
print("EAX-->%x" % eax_adddress)
print("FunctionName-->%s" % idc.get_func_name(eax_adddress))

0

Reduced to the minimum, this is how you get the name of a function and the module in Python 3:

import ida_funcs
import ida_nalt
import idc
import pathlib

eax_adddress = idc.get_reg_value('EAX')
func_name = ida_funcs.get_func_name(eax_address)

# if you want to use the main image name:
#image_name = pathlib.Path(ida_nalt.get_input_file_path()).name

# if you want to use the segment from which the function is coming from:
image_name = idc.get_segm_name(eax_adddress)

print(f'{image_name}:{func_name}')

Please note that this probably works properly only in case you have multiple images in the same database. Otherwise idc.get_segm_name might actually return the actual segment name, not the image name.

You can easily rewrite that for Python 2 if needed by not utilizing the pathlib and change the print()-function to be a print-statement in case you want to access the original image file name.

3
  • I was able to get the name of the EXE file and function name by using the method you taught me, but I was not able to get the name of the DLL that exported the function. The output of your code was shown the following. >malware.exe:ws2_32_shutdown
    – rou qwers
    Mar 15 at 1:48
  • Sorry, your question wasn't clear to me in that regard. I edited my snippet, it should do what you're asking for now.
    – new_turtle
    Mar 15 at 9:10
  • Hi new_turtle, thank you so much for your great kindness ! Thank you.
    – rou qwers
    Mar 15 at 13:25

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.