3

What I want:

  1. detect all potentially usercall, userpurge - functions;
  2. when entering the function, immediately see all external entities: arguments passed through registers;

i.e., in order not to waste time on their manual search and speed up the restoration of the calling convention.

those. I need. some plugin that:

  • either highlighted these registers (which is hardly possible - because then IDA will highlight them in all places)
  • or carefully write them out at the beginning of the function body, as a comment (which is more likely).

1 Answer 1

4

The answer to this question is to simply use Hex-Rays instead of IDA. It automatically does everything you've suggested, and the end result is the function's prototype, which will indicate register arguments in standard and non-standard locations.

If you don't want to do that, then the answer is to re-implement everything that Hex-Rays does in the course of producing that information: namely, prolog analysis, data flow analysis, and call analysis.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.