📚 OpenRCE is preserved as a read-only archive. Launched at RECon Montreal in 2005. Registration and posting are disabled.








Flag: Tornado! Hurricane!

 Forums >>  IDA Pro  >>  What is the til(type information library)

Topic created on: July 26, 2008 20:51 CDT by yinwenjiansusie .

In the IDA SDK,there is a header file----typeinfo.hpp.I find that a lot of functions and structures has mentioned the structure "til_t". In this file it is explained as type information library.
there are two structure in the file "typeinfo.hpp":
struct funcarg_info_t
{
  argloc_t argloc;      // argument location (stack offset or register if ARGLOC_REG)
  qstring name;         // argument name (might be empty)
  qtype type;           // argument type
  qtype fields;         // argument field names (used for local structure types)
};

struct func_type_info_t : public qvector<funcarg_info_t>
{
  int flags;
#define FTI_SPOILED 0x0001 // __spoils information is present
  qtype rettype;        // return type
  qtype retfields;      // return type field names (if structure)
  argloc_t retloc;      // return location
  uval_t stkargs;       // size of stack arguments
  reginfovec_t spoiled; // spoiled register information
                        // if spoiled register info is present, it overrides
                        // the standard spoil info (eax, edx, ecx for x86)
  cm_t cc;              // calling convention
  type_t basetype;      // function base type (the first byte of the type)
};

as we see,maybe it can get all the function type infomation. But the problem is some functions gained from the file such as build_funcarg_info(...),get_func_rettype(...), has the parameter " til_t *til". How can I related the " til_t *til" with the function type?
thanks for any hint!

  igorsk     July 27, 2008 07:09.23 CDT
You can use the global variable idati, which refers to the current IDB's type library.

  yinwenjiansusie     July 27, 2008 08:14.55 CDT
> igorsk: You can use the global variable idati, which refers to the current IDB\'s type library.

Thanks! I have tried to use this global variable.But there is a problem. Beacuse there is a lot of functions,how can I know which function does the idati related to?

Is there any method or function in the SDK that can solve the problem?

Thanks for any hint!

  igorsk     July 27, 2008 11:39.18 CDT
idati contains info about all types: functions, structures etc. You can use get_tinfo() to get type info for a location (e.g. function).
See example in the funclist plugin in SDK.

  yinwenjiansusie     July 29, 2008 05:30.50 CDT
> igorsk: idati contains info about all types: functions, structures etc. You can use get_tinfo() to get type info for a location (e.g. function).
> See example in the funclist plugin in SDK.
Thank,igorsk!The example "functionlist" helped me a lot!
I have another question. As we known, the function prototype can provide some function parameters information.And also, some fucntions in IDA have the stack frame which can provide some parameters information.What is difference? If I want to extract the parameters in the fucntion,which is mainly determined?
Yes,I know if the parameter is transfered by stack,there are some "push" instruction before "call *" instructions,which can provide the real parameters.But if the parameter is tranfered by regidter (for example,if the calling convention is __fastcall),how I find the real parameters? Is there any flag information like the "push" that can give a hint?

Note: Registration is required to post to the forums.

There are 31,328 total registered users.


Recently Created Topics
[help] Unpacking VMP...
Mar/12
Reverse Engineering ...
Jul/06
let 'IDAPython' impo...
Sep/24
set 'IDAPython' as t...
Sep/24
GuessType return une...
Sep/20
About retrieving the...
Sep/07
How to find specific...
Aug/15
How to get data depe...
Jul/07
Identify RVA data in...
May/06
Question about memor...
Dec/12


Recent Forum Posts
Finding the procedur...
rolEYder
Question about debbu...
rolEYder
Identify RVA data in...
sohlow
let 'IDAPython' impo...
sohlow
How to find specific...
hackgreti
Problem with ollydbg
sh3dow
How can I write olly...
sh3dow
New LoadMAP plugin v...
mefisto...
Intel pin in loaded ...
djnemo
OOP_RE tool available?
Bl4ckm4n


Recent Blog Entries
halsten
Mar/14
Breaking IonCUBE VM

oleavr
Oct/24
Anatomy of a code tracer

hasherezade
Sep/24
IAT Patcher - new tool for ...

oleavr
Aug/27
CryptoShark: code tracer ba...

oleavr
Jun/25
Build a debugger in 5 minutes

More ...


Recent Blog Comments
nieo on:
Mar/22
IAT Patcher - new tool for ...

djnemo on:
Nov/17
Kernel debugger vs user mod...

acel on:
Nov/14
Kernel debugger vs user mod...

pedram on:
Dec/21
frida.github.io: scriptable...

capadleman on:
Jun/19
Using NtCreateThreadEx for ...

More ...


Imagery
SoySauce Blueprint
Jun 6, 2008

[+] expand

View Gallery (11) / Submit