2

Test platform is Linux 32 bit, ELF file, GNU coreutils.

Basically I am trying dump all the functions using IDC script, here is part of my IDC script:

for (addr = NextFunction(addr); addr != BADADDR; addr = NextFunction(addr)) {
    name = Name(addr);
    end = GetFunctionAttr(addr, FUNCATTR_END);
    locals = GetFunctionAttr(addr, FUNCATTR_FRSIZE);
    frame = GetFrame(addr);
    ret = GetMemberOffset(frame, " r");
    if (ret == -1) continue;
    firstArg = ret + 4;
    args = GetStrucSize(frame) - firstArg;

    dumpFunction(name, addr, end);
}

I am using it to test GNU coretuils, and I find some functions like

            public qset_acl
            qset_acl        proc near

            jmp     chmod_or_fchmod
            qset_acl        endp

which can not be found by this script.

Am I doing something wrong? Could any one give me some help?

Thank you!

  • 4
    Check the stack frame of that function (CTRL-K) to see if it does in fact define the " r" member, otherwise you will skip it with the continue statement. – Rolf Rolles Feb 14 '14 at 0:19
2

The stack frame structure is not created unless necessary (i.e. the function accesses a stack argument or local variable), so these stub functions get skipped by your (ret == -1) check.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.