2

On Linux 32 bit, I use IDA Pro + IDC script to dump all the functions. Here is part of the script:

addr = 0;
for (addr = NextFunction(addr); addr != BADADDR; addr = NextFunction(addr)) {
    name = Name(addr);
    end = GetFunctionAttr(addr, FUNCATTR_END);
    Message("%s:\n", name);

    dumpFunction(name, addr, end);
}

Certain functions, like close_stdin defined in GNU coreutils static library, can not be found in this script but I can find those functions in File->Produce File->Create ASM File...

Is there something wrong with my script? Can I use it to find out all the functions?

1 Answer 1

4

Your script is OK. IDA possibly doesn't recognize your function as a function during auto-analysis and that's a possible problem. If you will go to the address of this function in IDA pro, press P in disassembly view on this address and rerun the script you'll possibly have your function dumped.

There is a very incorrect solution for this problem (incorrect means that it is not always provide good/correct results). If you will pass on any non-function area and create functions automatically with the script below everything that was not defined as function before will be dumped with your script, but I'm not sure for correctness of these results.

#I didn't check this code, run on your own risk, 
#use carefully, beware errors

import idaapi
import idc

segm = idaapi.get_segm_by_name(".text")
start = segm.startEA
end = segm.endEA

while start < end:

  start = idaapi.find_not_func(start, 1)
  print "Attempt to create function at", hex(start)
  idc.MakeFunction(start)

  start += 1 # for a case of any error 

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.