1

Let's say I have:

mov ecx, [g_pMyClassObj] ; type CMyClass
call sub_B00BA ; a thiscall function

Is there a feature/plugin/script to automatically rename all subroutine occurrences to:

mov ecx, [g_pMyClassObj] ; type CMyClass
call CMyClass__B00BA
2
  • Which Ida version are you using? Do you have HexRays decompiler?
    – w s
    Aug 2 at 14:27
  • I am using IDA version 7.7, And yes I have HexRays Decompiler and use it. Aug 2 at 15:34

1 Answer 1

0

As far as IDA is concerned it's almost programmable in every manner thanks to the scripting engine. When it comes to renaming a subroutine in IDA it can be achieved either using idc scripts or by using idapython.

Although renaming class methods in IDA automatically can be a tough task because you have to provide much more information to IDA such as object-name, calling conventions etc. However, a more general occurrence of a subroutine can easily be renamed using idc script.

I have provided a script below which can solve this problem. Although it can be modified to extract the subroutine offset B00BA from sub_B00BA and rename (or rather append) to a name of your liking, but I left that approach so that this script can more flexible (i.e you can change to any name and not just SomeSubName_Offset).

idc script: rename_method.idc

#include <idc.idc>

static main(void)
{
    auto ea, fncname, fstatus=-1;
    auto findsub="sub_B00BA";           // [1] Subroutine to find
    auto newsubName="CMyClass__B00BA" ; // [2] New name the subroutine 
    for (ea=MinEA(); ea != BADADDR; ea=NextFunction(ea))
    {
        fncname = GetFunctionName(ea);                
        if (fncname == findsub) 
        {
            auto errcode = MakeNameEx(ea, newsubName, SN_PUBLIC|SN_CHECK|SN_NOWARN);
            if (errcode)
            {
                Refresh();
                RefreshLists();
                Message("[*] disassembly/subroutine-list refreshed..ok\n");
            }
            fstatus=1;
            return;
        }
    }
        if (fstatus == -1)  // if we don't have such function in disassembly
        {
            Message("[*] subroutine:" + findsub +
            " not found.\nplease check name of the subroutine/method again.\n");
        }
}

Please make sure you change subroutine name at [1] and [2]. I have tested this scipt using IDA 6.6 and will definately work with IDA 7.x.

1
  • 1
    This is one piece of the puzzle. Thank you for your contribution! Aug 2 at 15:38

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.