📚 OpenRCE is preserved as a read-only archive. Launched at RECon Montreal in 2005. Registration and posting are disabled.








Flag: Tornado! Hurricane!

 Forums >>  IDA Pro  >>  Set Function Type

Topic created on: June 29, 2007 03:08 CDT by luckiejacky .

Hi,
When you right-click on the function name, you'll get the guessed function type. Say
sub_1234
you'll get
sub_1234(int,int,int);
how can I get the string like this thru the SDK?
I found somethin like this from

typeinf.hpp

// calculate function argument locations
//      type    - pointer to function type string
//      arglocs - the result array
//                each entry in the array will contain an offset from the stack pointer
//                for the first stack argument the offset will be zero
//                register locations are represented like this: the register number combined with ARGLOC_REG
//      maxn    - number of elements in arglocs
// returns: number_of_arguments. -1 means error.
//      type is advanced to the function argument types array

inline int calc_arglocs(const type_t *&type, ulong *arglocs, int maxn)
{
  if ( !ph.ti() || !is_type_func(*type) ) return -1;
  return ph.notify(ph.calc_arglocs, &type, arglocs, maxn);
}

Any suggestions on exactly how to go about getting this string will be greatly appreciated!
Jack

  luckiejacky   June 29, 2007 03:25.40 CDT
Yes, i've found somethin'

/ To retrieve the type information attach to an address, use get_ti() function
// (see nalt.hpp)

// generate a type string using information about the function
// from the disassembly. you could use guess_type() function instead of this function
idaman int ida_export guess_func_type(func_t *pfn,
                    type_t *type,
                    size_t tsize,
                    p_list *fields,
                    size_t fsize);
#define GUESS_FUNC_FAILED   0   // couldn't guess the function type
#define GUESS_FUNC_TRIVIAL  1   // the function type doesnt' have interesting info
#define GUESS_FUNC_OK       2   // ok, some non-trivial information is gathered


// generate a type string using information about the id from the disassembly
idaman int ida_export guess_type(
                    tid_t id,           // or address
                    type_t *type,
                    size_t tsize,
                    p_list *fields,
                    size_t fsize);

But I don't get what tsize, fields and fsize are...

  dnix   July 18, 2007 16:41.43 CDT
I once used something like this , don't know if this might help

write_functions_protos(ea_t start_ea){

char buf[MAXSTR] = {0};
char seg_name[MAXSTR] = {0};

//print prototypes to buf and output to .h file
//guess prototype if not explicitly set by "Y" in ida
type_t * types = new type_t [MAXSTR];
p_list * fields = new p_list [MAXSTR];

//type_t * types = (type_t *)malloc (MAXSTR);
//p_list * fields = (p_list *)malloc (MAXSTR);
size_t tsize = 100;
size_t fsize = 100;

//guess_type(start_ea,types,tsize,fields,fsize);
//set_ti(start_ea, types, fields);
print_type(start_ea, buf, MAXSTR, 0);


//free(types);
//free(fields);

if (buf != NULL && *buf != '\0'){
//out_str(&hfile ,"extern \"C\"\t");
out_str(&hfile,"\t");
out_str(&hfile, buf);
out_str(&hfile,";\n");
}else{
guess_type(start_ea,types,tsize,fields,fsize);
set_ti(start_ea, types, fields);
print_type(start_ea, buf, MAXSTR, 0);

//out_str(&hfile ,"extern \"C\"\t");
out_str(&hfile,"\t");
out_str(&hfile,buf);
out_str(&hfile,";\n");
get_segm_name(start_ea,seg_name,MAXSTR);
msg("%s:%08x: no explicit function prototype applying guess\n",seg_name);

}

Note: Registration is required to post to the forums.

There are 31,328 total registered users.


Recently Created Topics
[help] Unpacking VMP...
Mar/12
Reverse Engineering ...
Jul/06
let 'IDAPython' impo...
Sep/24
set 'IDAPython' as t...
Sep/24
GuessType return une...
Sep/20
About retrieving the...
Sep/07
How to find specific...
Aug/15
How to get data depe...
Jul/07
Identify RVA data in...
May/06
Question about memor...
Dec/12


Recent Forum Posts
Finding the procedur...
rolEYder
Question about debbu...
rolEYder
Identify RVA data in...
sohlow
let 'IDAPython' impo...
sohlow
How to find specific...
hackgreti
Problem with ollydbg
sh3dow
How can I write olly...
sh3dow
New LoadMAP plugin v...
mefisto...
Intel pin in loaded ...
djnemo
OOP_RE tool available?
Bl4ckm4n


Recent Blog Entries
halsten
Mar/14
Breaking IonCUBE VM

oleavr
Oct/24
Anatomy of a code tracer

hasherezade
Sep/24
IAT Patcher - new tool for ...

oleavr
Aug/27
CryptoShark: code tracer ba...

oleavr
Jun/25
Build a debugger in 5 minutes

More ...


Recent Blog Comments
nieo on:
Mar/22
IAT Patcher - new tool for ...

djnemo on:
Nov/17
Kernel debugger vs user mod...

acel on:
Nov/14
Kernel debugger vs user mod...

pedram on:
Dec/21
frida.github.io: scriptable...

capadleman on:
Jun/19
Using NtCreateThreadEx for ...

More ...


Imagery
SoySauce Blueprint
Jun 6, 2008

[+] expand

View Gallery (11) / Submit