3

What I want:

  1. detect all potentially usercall, userpurge - functions;
  2. when entering the function, immediately see all external entities: arguments passed through registers;

i.e., in order not to waste time on their manual search and speed up the restoration of the calling convention.

those. I need. some plugin that:

  • either highlighted these registers (which is hardly possible - because then IDA will highlight them in all places)
  • or carefully write them out at the beginning of the function body, as a comment (which is more likely).

1 Answer 1

4

The answer to this question is to simply use Hex-Rays instead of IDA. It automatically does everything you've suggested, and the end result is the function's prototype, which will indicate register arguments in standard and non-standard locations.

If you don't want to do that, then the answer is to re-implement everything that Hex-Rays does in the course of producing that information: namely, prolog analysis, data flow analysis, and call analysis.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.