1

I am going through a huge executable and am fetching information about functions arguments this way:

tif, funcdata = ida_typeinf.tinfo_t(), ida_typeinf.func_type_data_t()

assert ida_nalt.get_tinfo(tif, ea)
assert tif.get_func_details(funcdata)

However, sometimes the get_func_details method fails (returns False) for seemingly no reason. If I then manually go to that ea, in pseudocode view, and then rerun the above code for that ea, get_func_details returns True and everything works fine again. It looks as if it's some "not actually loaded to memory" or "need to initialize something, first" kind of issue.

I have worked around the problem by simply checking the return value of get_func_details and if False, then I call idaapi.decompile(ea) to make it "refresh" memory and rerun my function that obtains funcdata and that seems to work.

The question is:

  1. Why does this actually happen?
  2. What is the correct way to prevent this?

I don't want to resort to decompiling functions because it's slow and seems to be an overkill.

Note: the executable has around 200k functions and out of the 5k+ functions that I have analyzed this way, only a single one required me to decompile it to make it work, so I highly doubt that the decompiling part is actually required here

1 Answer 1

1

IDA needs to decompile the function to work out the function details. If a function gets decompiled the first time, the details are stored in the database. They are updated later when you use the "set function type" operation.

So, you can't avoid to decompile the functions if you require information that is generated by exactly that decompilation.

3
  • Out of the 5k+ functions that I have touched this way, in a newly loaded executable, only a single one required opening it in the decompiler. I highly doubt that the decompiler is actually required for using IDA functions that work with the disassembler part of IDA
    – overflo
    Aug 19, 2022 at 13:26
  • @overflo so there must be something different about this function. What is it?
    – Igor Skochinsky
    Aug 19, 2022 at 16:40
  • I suspect that the function that needs to be decompiled doesn't call any known library functions, so the simple data flow analysis and type propagation of IDA won't guess the function signature, and only Hex-Rays is smart enough to guess a signature. Aug 19, 2022 at 17:14

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.