0

I'd like to import structs and functions from a reflection system into IDA.

The problem I have is with functions. So I have all the type information: namespace, class name, function name, calling convention, return type, argument types and names and the function address. But it's very tricky to import this information into IDA. Because even if I generate a name like public static __stdcall void MyClass1::Function1(MyClass2& Parameter1), I can't just name the function, I need a mangled name.

So that's the question: how to import all the information about functions into IDA? Assume I have all the type information and function addresses from the reflection system in a database ready to be imported.

I already wrote two scripts, first one creates a database of addresses and mangled function names from the reflection system in the form:

0x402d2f0   ?FunctionName@ClassName@@QEAAXXZ
0x402d3f0   ?FunctionName2@ClassName@@QEAAXXZ
0x403d2f0   ?FunctionName@ClassName2@@QEAAXXZ

This is a mangled name for a void member function with the specified class name that I got by compiling a simple program at Godbolt compiler explorer.

Then a second script in IDA goes over this database and just names the functions using names from the database. But the functions miss the return types and arguments, and also I believe all the overloaded functions are not getting named, because the name already exists.

I feel like I need to find a name mangler that would create mangled names from the type information that I provide, and then just name the functions in IDA.

I got recommended to try to use LLVM project, but I'm not sure how hard it would be to make LLVM give me mangled names. The MicrosoftCXXNameMangler and the type information classes it uses to create mangled names look like deep classes that would be hard to properly instantiate and use.

4
  • Do you have type definitions for the classes in question, or just their names (by virtue of them appearing in the reflection metadata)? Nov 20, 2023 at 19:25
  • @RolfRolles I do have class definitions, too: names, alignment, size, each field alignment, type, size.
    – KulaGGin
    Nov 20, 2023 at 19:42
  • Do the names contain a bunch of C++ template stuff, characters like <, ,, ` `, etc? Nov 20, 2023 at 23:21
  • @RolfRolles Sometimes the functions are specific instances for templated classes and functions. So they have <> and template arguments provided. But mostly no.
    – KulaGGin
    Nov 21, 2023 at 10:32

0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Browse other questions tagged or ask your own question.