0

Sometime Ida didn't parse some function into binary , so I search the beginning of function (in Arm it's PUSH {R4-*,LR} and press P -create a function.

How can I do it automatically for all undefined function with IdaPython ? How can I run on all over "Instruction area" and try to parse function?

1

I use this code snippet when I need to find, define, and do the auto-analysis of every function starting by a specific stub:

from idaapi import *
from ida_search import *
from ida_funcs import *

cnt = 0
my_pattern = '' # The hex value of the opcodes you are looking for

def is_function(start_addr):
   content = get_bytes(start_addr, 4, False).hex()
   if content == my_pattern:
      return True
   return False

addr = find_unknown(0, 1)
while addr != BADADDR
   is_valid = is_function(addr)
   if is_valid:
      add_func(addr)
      cnt += 1
   addr = find_unknown(addr, 1)

print('A total of ' + str(cnt) + ' new functions where defined')

In your, case, replace my_pattern by the opcodes of the pattern that you are looking for. For instance, in ARM, the "MOV R12, SP" instruction is a good indicator of a new function, so I set my_pattern = '0DC0A0E1'

More details on this through this similar question: How to know when a subroutine starts when reversing an ARM64 file?

0

You probably need the following IDAPython functions:

Full documentation about IDAPython is here

1
  • The problem is that idc.GetDisasm works only if the address is code, so you need first convert the address to code with idaap.create_insn there is no function that try to convert data to code without make change into IDB Aug 25 at 9:22

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.