2

I'm trying to catch epilogue/prologue of functions in IDApython. Anyone got clue/snippet/algorithm of how should I do this?

6
  • 1
    What architecture? Are you trying to find things you think IDA is missing? IDA can already tell you the beginning and end of every function it knows about so I assume you are interested in something more? Mar 14 '14 at 4:36
  • my target arch is x86. nothing hidden from isa, i want to programmatically enumerate all epilogue/prologue and continue my research.
    – user3119
    Mar 14 '14 at 5:05
  • 2
    Why do you need the epilogue? How do you even define what is an "epilogue"? Once you found, what do you want to do with it? So far this looks like a classic XY problem.
    – Igor Skochinsky
    Mar 14 '14 at 12:42
  • I define it as "basic block before ret/ret n". I want to know all epilogue of my program has how many bytes.
    – user3119
    Mar 14 '14 at 13:30
  • 1
    This isn't simple. What compiler was the binary compiled with? Is it using cdecl or fastcall? thiscall? Is it a pure C program or is it a C++ program? All of these calling conventions will affect the resulting prolog/epilogue
    – avgvstvs
    Mar 14 '14 at 14:21
3

Still not entirely clear what you are hoping to do. IDA has no function that will return to you a function's prologue or epilogue. Here is some code that will iterate over all functions with some suggestions of things you might add:

for s in idautils.Functions():
   f = idaapi.get_func(s)
   e = f.endEA
   #s is the start of the function e is the end of the function
   #You can iterate over a functions items with the following
   for i in idautils.FuncItems(s):
      #i is the ea of each function item
      print "%x" % i

If you have some idea of specific prologues and epilogues you are looking for (push ebp/move ebp, esp? leave/ret? pop ebp/ret?) you can always try to match the corresponding opcode sequences around the start and end EAs.

1
  • End of the function is not always function epilogue. In addition, this will work only for functions that were defined by autoanalysis and manually, but will not work for not-recognized-yet functions.
    – w s
    Mar 14 '14 at 10:26
1

Although I'm not entirely sure what your end goal is, I have found myself when working with firmware dumps needing to find functions. Depending on the architecture, this can get interesting when you talk about function prologues. I found this script from Milad Kahsari Alhadi Blog to be useful and might be a good reference for you to look at. Effectively, this script goes through the functions that (as W S commented above) have manually defined or were defined in auto analysis and enumerates part of their "prologue", then attempts to find similar byte strings within the binary and attempts to MakeCode on them.

In the past, I have modified this script to run against one file that analyzes well in IDA (aka an ELF for the same architecture) and then spit out the "prologues" to use against a firmware image that I was too lazy to manually find functions.

NOTE: I put prologue in quotes because really this script is just taking the first opcode and checking it against mnemonics we "like". So its not truly finding arbitrary prologues which might be what you are after.

Not the answer you're looking for? Browse other questions tagged or ask your own question.