2

Test platform is Linux 32 bit, ELF file, GNU coreutils.

Basically I am trying dump all the functions using IDC script, here is part of my IDC script:

for (addr = NextFunction(addr); addr != BADADDR; addr = NextFunction(addr)) {
    name = Name(addr);
    end = GetFunctionAttr(addr, FUNCATTR_END);
    locals = GetFunctionAttr(addr, FUNCATTR_FRSIZE);
    frame = GetFrame(addr);
    ret = GetMemberOffset(frame, " r");
    if (ret == -1) continue;
    firstArg = ret + 4;
    args = GetStrucSize(frame) - firstArg;

    dumpFunction(name, addr, end);
}

I am using it to test GNU coretuils, and I find some functions like

            public qset_acl
            qset_acl        proc near

            jmp     chmod_or_fchmod
            qset_acl        endp

which can not be found by this script.

Am I doing something wrong? Could any one give me some help?

Thank you!

1
  • 4
    Check the stack frame of that function (CTRL-K) to see if it does in fact define the " r" member, otherwise you will skip it with the continue statement. Feb 14, 2014 at 0:19

1 Answer 1

2

The stack frame structure is not created unless necessary (i.e. the function accesses a stack argument or local variable), so these stub functions get skipped by your (ret == -1) check.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.