2

I have a 64-bit Mach-O sample that uses the System V AMD64 ABI calling convention (rdi, rsi, rdx, rcx,...); but IDA thinks all the functions are using cdecl. I'm new to IDA scripting but didn't find any information in the docs. My goal is to convert all the function types to:

type __usercall function<rax>(type name0<rdi>, type name1<rsi>, ...)

Related: is there a way to read the arguments and/or number of arguments from the function definition?

3

Use idc.SetType (see documentation here ) It works exactly the same as pressing y on function and defining the type, but you have to add semicolon to the end of the type definition.

1

There is no need to do anything. For x64 Mach-O and ELF files, cdecl is the same as fastcall and means SysV AMD64 ABI.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.