3

I'm looking for ways to quickly triage applications when I'm reverse engineering and I've been looking at solutions that have already been written before I write my own I saw funcap (https://github.com/deresz/funcap/) mentioned in another question here and it looked like exactly what I wanted.

However, I've loaded/run the script and it doesn't look like it's doing anything. I get messages saying it's on and off, but other than that no output. It's also asked me to select a debugger so I know the script is running but there's no output or notes added to the idb.

When the plugin was published it said there was a lot of documentation available but it doesn't look like anyone else has had this issue. I've tried running the script and the running the process in a debugger, and breaking at the beginning of a processor and then running the script and in both situations it hasn't worked.

I feel like this is a dumb question but I was hoping someone else here had experience using this script, or a similar one and could point towards what I'm doing wrong. I'm on IDA 6.3 if that makes a difference.

Edit: I forgot to mention above the original reason I was looking at the script is I'd just like something to quickly tag functions and their parameters. funcap looks like the only one I've run into that can do this. I've also looked at doing something with PIN but it seemed like (at the time) this would be easier.

  • github.com/deresz/funcap - "All calls are also logged by default to the console and to a file (by default %USERPROFILE%\funcap.txt or ~/funcap.txt) as you can see on the following example". Do you have anything written to this location? – Mick Jan 7 '15 at 14:50

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.