1

I want to get a function's signature information: return type and parameters from x64 binaries. I am able to achieve so, using

tif = idaapi.tinfo_t()
ida_nalt.get_tinfo(tif, ea)
function_type = tif.get_rettype()
metadata[function]["ret_type"] = function_type
funcdata = ida_typeinf.func_type_data_t()
for i,v in enumerate(funcdata):
        itype = ida_typeinf.print_tinfo('', 0, 0, idc.PRTYPE_1LINE, v.type, '', '')
        metadata[function]["parameter_list"].append(tuple([i, v.name,itype]))

This script works in a lot of cases, but fails in some simple cases, like for example

double retDouble()
{
  return 2.4;
}

In such case, I get an empty tif object, and thus I can't recover the return type — which is double in this case. I believe this happens in cases where there are no function parameters present (like in above case). In such case, How can I recover the return type (or at least recover the type, or is it not possible at all)? I want the type object and not the type as a string, the later can be achievable by parsing IDA disassembly and retrieving function signature by something like regex.

Improve this question

1 Answer 1

Reset to default
1

The return type is available in the rettype field of the func_type_data_t structure.

Improve this answer
7
  • thanks for your comment, but function_details = idaapi.func_type_data_t(); func_tinfo.get_func_details(function_details) still gives me black output
    – R4444
    Dec 3, 2021 at 1:30
  • @R4444 check that the type is actually a function type (tif.is_func())
    – Igor Skochinsky ♦
    Dec 3, 2021 at 18:25
  • yes, I just checked. it gives me False for some functions and True for some
    – R4444
    Dec 5, 2021 at 1:39
  • well, return type is only available for function types
    – Igor Skochinsky ♦
    Dec 5, 2021 at 1:47
  • 1
    Decomplier has its own type info which may be not present in the database. If you do Y, Enter in the function header in the decompiler then it will be stored in the database.
    – Igor Skochinsky ♦
    Dec 5, 2021 at 2:06

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.