1

I open .exe file in IDA with .pdb attached to it, so IDA scans .pdb and shows function names.

I need to get signature strings of many functions. I can't do it manually so I want to use built-it IDA Python console

For example: function on address 00007FF68E528660 has signature int __fastcall lua_error(lua_State *L)

I got my function address (ea)

def GetFunctionByName(name):
    ea = BeginEA()
    for funcAddr in Functions(SegStart(ea), SegEnd(ea)):
        funcName = GetFunctionName(funcAddr)
        if funcName == name:
            return funcAddr
    return None
print function_i_need(GetFunctionByName("lua_error"))

#should print "int __fastcall lua_error(lua_State *L)" or something familiar

I don't know how to implement function_i_need

How do I get that signature string using python code?

1 Answer 1

1

if you can use idc or adapt idc to python you can do some thing like this

#include <idc.idc>
static main() 
{
    auto funfirst,funnext,i = 0;
    funfirst = get_next_func( MinEA() );
    while (funnext != BADADDR) 
    {
        Message("fun[%04d] %x %s\n" ,i++ , funfirst, get_name(funfirst,GN_DEMANGLED));
        funnext = get_next_func(funfirst); 
        funfirst = funnext;
    }
}

should yield names as follows

fun[0000] 180001008 private: static long AppContainerRegistration::CreateAppContainerKeySecurityDescriptor(struct _GUID const *,void *,void *,void *,unsigned long,unsigned long *,void * *,unsigned short *)
fun[0001] 1800014e0 UrlHashW
fun[0002] 180001590 UrlHashA
fun[0003] 1800015e8 void _HashData(unsigned char const *,unsigned long,unsigned char *,unsigned long)
fun[0004] 180001660 SystemTimeToTzSpecificLocalTimeEx
fun[0005] 18000190c AddTimeZoneRules
fun[0006] 180001ad4 AddTimeZoneRule
fun[0007] 180001b28 RtlpGetLastBias
fun[0008] 180001b60 StrRChrIW
fun[0009] 180001bcc public: long StateSpace::CreateSystemAppDataRoamingSubkey(struct HKEY__ * *)
3
  • Not working. get_name(0x00007FF758D185B0, GN_DEMANGLED) outputs lua_createtable. It's not signature. It's just a name of a function
    – Forprix
    Dec 22, 2021 at 23:21
  • if it shows up in ida functions window it should print here if ida has just name then it will print name as my output shows both types. urlhashw is just name without type info
    – blabb
    Dec 23, 2021 at 1:36
  • @Forprix if the function prototype is known to IDA it will be printed here. If not (e.g. lack of symbolic information, no or improper signatures loaded), then it will merely use whatever the suitable name (likely from a symbol table such as the export table of a DLL).
    – 0xC0000022L
    Jan 21 at 23:05

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.