2

I use IDA Pro 6.1 to disassembly ELF file, which is compiled on 32 bit Linux, gcc 4.6.3

I modified the code and try to make it reassemble, and I find a problem here(this is directly created by IDA Pro):

main    proc near
......
mov     dword ptr [esp+4], offset msgid
......
......
foo     proc near
msgid   =  dword ptr -18d
......
mov     [esp+1Ch+msgid], 1

section .rodata
msgid           db 'extra operand %s',0

So if I do some modify work and assembly it use nasm, it will produce this error:

error: label or instruction expected at start of line 

targeting on this line:

msgid           db 'extra operand %s',0

If I modify it like this:

main    proc near
......
mov     dword ptr [esp+4], offset msgid111
......
......
foo     proc near
msgid   =  dword ptr -18d
......
mov     [esp+1Ch+msgid], 1

section .rodata
msgid111           db 'extra operand %s',0

Then no error in this part.

So my questions are:

  1. Why IDA Pro will use variable name as the macro name?
  2. Is there any better way to bypass this error than modify the variable name?

Thank you!

1 Answer 1

3
  1. IDA will use this variable name if you renamed it somehow. This variable name is local for the function because it is a stack offset.

  2. There is no better way than name modification. You can solve this specific kind of error by writing script that renames anything in .rodata section by applying g_ prefix to any object in it.

The code will look like this:

#Use carefully, I didn't check this code
#beware errors

import idautils
import idc

prefixes = {".rodata": "g_ro_",
            ".data": "g_"}

#Passing over all non default names
for (ea, name) in idautils.Names():
    seg_name = idc.SegName(ea)
    # if the name is in required segment
    if seg_name in prefixes:
        if not name.startswith(prefixes[seg_name]):
            # renaming it by adding required prefix
            # if the prefix is not added yet
            name = prefixes[seg_name] + name
            idc.MakeName(ea, name)

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.