I have run the Class Informer plugin to identify virtual method tables. I am trying to write a python script which will rename each function in the table. I am struggling to find the correct API call to change an .rdata subroutine name. I have read through this guide, but I'm still confused: http://www.offensivecomputing.net/papers/IDAPythonIntro.pdf

e.g., if I have this vmt for ExampleClassA:

.rdata:004F0EE8     ??_7?$ExampleClassA@$@@@ dd offset sub_25DFAD
.rdata:004F0EE8                                             ; DATA XREF: sub_256CB0+98
.rdata:004F0EE8                                             ; CNetChan____45+86 ...
.rdata:004F0EEC                     dd offset sub_3B0760
.rdata:004F0EF0                     dd offset sub_1A2080

I want to enter the base address ( 0x004F0EE8 ) and iterate over the table to rename each subroutine based on a user-supplied name. I can iterate, get input, move ea.

How do I modify the subroutine name of the current line?


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.