0

I want to get a function's signature information: return type and parameters from x64 binaries. I am able to achieve so, using

tif = idaapi.tinfo_t()
ida_nalt.get_tinfo(tif, ea)
function_type = tif.get_rettype()
metadata[function]["ret_type"] = function_type
funcdata = ida_typeinf.func_type_data_t()
for i,v in enumerate(funcdata):
        itype = ida_typeinf.print_tinfo('', 0, 0, idc.PRTYPE_1LINE, v.type, '', '')
        metadata[function]["parameter_list"].append(tuple([i, v.name,itype]))

This script works in a lot of cases, but fails in some simple cases, like for example

double retDouble()
{
  return 2.4;
}

In such case, I get an empty tif object, and thus I can't recover the return type — which is double in this case. I believe this happens in cases where there are no function parameters present (like in above case). In such case, How can I recover the return type (or at least recover the type, or is it not possible at all)? I want the type object and not the type as a string, the later can be achievable by parsing IDA disassembly and retrieving function signature by something like regex.

1

The return type is available in the rettype field of the func_type_data_t structure.

7
  • thanks for your comment, but function_details = idaapi.func_type_data_t(); func_tinfo.get_func_details(function_details) still gives me black output
    – R4444
    Dec 3 '21 at 1:30
  • @R4444 check that the type is actually a function type (tif.is_func())
    – Igor Skochinsky
    Dec 3 '21 at 18:25
  • yes, I just checked. it gives me False for some functions and True for some
    – R4444
    Dec 5 '21 at 1:39
  • well, return type is only available for function types
    – Igor Skochinsky
    Dec 5 '21 at 1:47
  • 1
    Decomplier has its own type info which may be not present in the database. If you do Y, Enter in the function header in the decompiler then it will be stored in the database.
    – Igor Skochinsky
    Dec 5 '21 at 2:06

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.