OpenRCE

About Articles Book Store Distributed RCE Downloads Event Calendar Forums Live Discussion Reference Library RSS Feeds Search Users What's New

Customize Theme

Flag: Tornado! Hurricane!

Created: Tuesday, May 13 2008 03:15.32 CDT

Modified: Tuesday, May 13 2008 03:30.31 CDT

Printer Friendly ...

"Function String Associate" IDA Plug-in

Author: Sirmabus

# Views: 12702

"Function String Associate"  IDA Plug-in:

I thought of this idea the other day based on the observation of "assert()", development, debug text strings, etc., that software developers often leave in programs I want to reverse.
As I'm sure others do, I look at these comments to help me determine what a particular function is for (x86 binary targets that is).
I thought, wouldn't be nice to somehow data mine this stuff and automatically put some of it as a function comment?

Based on this, what this plug-in does is iterate through every function in IDA and auto-comments every function that has these strings (unless it already has a comment).  It applies a little logic to it, to try to put the most relevant strings first.

Sort of a proof of concept thing.  It's hard to say how useful it is yet.
So far it does seem to help as I browse around a DB. I'm putting together things a bit faster because of it.

Of course it's only works as well as your target uses such messages mixed in it's code.
So far on programs I've used it it on, the plug-in finds such strings on about 15% of all functions.

With source. If you expand on the idea, add helpful modifications, etc., share it here please.

http://www.openrce.org/repositories/users/Sirmabus/IDA_FunctionStringAssociate_PlugIn.zip

Blog Comments

Raindog	Posted: Wednesday, May 14 2008 01:48.40 CDT
Why don't you write a script that will parse names such as: "foo_t::bar() requires to be called this way" rip the foo_t::bar() out, change it to foo_t__bar and rename the function? I'm going to do that when I have the time.

Sirmabus

Posted: Wednesday, May 14 2008 04:52.59 CDT

Ya, that's an idea. I consider that, but the problem is a reference like that doesn't necessarily mean it's "foo_t::bar()".

Might still be useful to do that taking the assumption it's really the function all the time.
You could when the name set fails (assuming the name is taken) start appending with '_' then an a index number.
I.E. "foo_t::bar_0", "foo_t::bar_1" ... "foo_t::bar_99", etc.

FYI you don't need, and probably don't want to rename to "foo_t__bar". IDA will accecpt "foo_t::bar" as a name, it will just display it as "foo_t__bar" for you..

There are 31,320 total registered users.

Recently Created Topics
[help] Unpacking VMP...	Mar/12
Reverse Engineering ...	Jul/06
hi!	Jul/01
let 'IDAPython' impo...	Sep/24
set 'IDAPython' as t...	Sep/24
GuessType return une...	Sep/20
About retrieving the...	Sep/07
How to find specific...	Aug/15
How to get data depe...	Jul/07
Identify RVA data in...	May/06

Recent Forum Posts
Finding the procedur...	rolEYder
Question about debbu...	rolEYder
Identify RVA data in...	sohlow
let 'IDAPython' impo...	sohlow
How to find specific...	hackgreti
Problem with ollydbg	sh3dow
How can I write olly...	sh3dow
New LoadMAP plugin v...	mefisto...
Intel pin in loaded ...	djnemo
OOP_RE tool available?	Bl4ckm4n

Recent Blog Entries
	halsten	Mar/14
Breaking IonCUBE VM
	oleavr	Oct/24
Anatomy of a code tracer
	hasherezade	Sep/24
IAT Patcher - new tool for ...
	oleavr	Aug/27
CryptoShark: code tracer ba...
	oleavr	Jun/25
Build a debugger in 5 minutes
More ...

Recent Blog Comments
	nieo on:	Mar/22
IAT Patcher - new tool for ...
	djnemo on:	Nov/17
Kernel debugger vs user mod...
	acel on:	Nov/14
Kernel debugger vs user mod...
	pedram on:	Dec/21
frida.github.io: scriptable...
	capadleman on:	Jun/19
Using NtCreateThreadEx for ...
More ...

Imagery

SoySauce Blueprint
Jun 6, 2008

[+] expand

View Gallery (11) / Submit