Try to parse all functions with IdaPython

Question

Sometime Ida didn't parse some function into binary , so I search the beginning of function (in Arm it's PUSH {R4-*,LR} and press P -create a function.

How can I do it automatically for all undefined function with IdaPython ? How can I run on all over "Instruction area" and try to parse function?

Answer 1

I use this code snippet when I need to find, define, and do the auto-analysis of every function starting by a specific stub:

from idaapi import *
from ida_search import *
from ida_funcs import *

cnt = 0
my_pattern = '' # The hex value of the opcodes you are looking for

def is_function(start_addr):
   content = get_bytes(start_addr, 4, False).hex()
   if content == my_pattern:
      return True
   return False

addr = find_unknown(0, 1)
while addr != BADADDR
   is_valid = is_function(addr)
   if is_valid:
      add_func(addr)
      cnt += 1
   addr = find_unknown(addr, 1)

print('A total of ' + str(cnt) + ' new functions where defined')

In your, case, replace my_pattern by the opcodes of the pattern that you are looking for. For instance, in ARM, the "MOV R12, SP" instruction is a good indicator of a new function, so I set my_pattern = '0DC0A0E1'

More details on this through this similar question: How to know when a subroutine starts when reversing an ARM64 file?

Answer 2

You probably need the following IDAPython functions:

• idautils.Heads for iterating over the segment
• idc.MakeFunction for creating a function
• idc.GetDisasm for getting the disassembly text of an instruction

Full documentation about IDAPython is here