"Function String Associate" IDA Plug-in
Jim Lacy (Sirmabus) <jimlacy2003yahoocom> Tuesday, May 13 2008 03:15.32 CDT


"Function String Associate"  IDA Plug-in:

I thought of this idea the other day based on the observation of "assert()", development, debug text strings, etc., that software developers often leave in programs I want to reverse.
As I'm sure others do, I look at these comments to help me determine what a particular function is for (x86 binary targets that is).
I thought, wouldn't be nice to somehow data mine this stuff and automatically put some of it as a function comment?

Based on this, what this plug-in does is iterate through every function in IDA and auto-comments every function that has these strings (unless it already has a comment).  It applies a little logic to it, to try to put the most relevant strings first.

Sort of a proof of concept thing.  It's hard to say how useful it is yet.
So far it does seem to help as I browse around a DB. I'm putting together things a bit faster because of it.

Of course it's only works as well as your target uses such messages mixed in it's code.
So far on programs I've used it it on, the plug-in finds such strings on about 15% of all functions.

With source. If you expand on the idea, add helpful modifications, etc., share it here please.

http://www.openrce.org/repositories/users/Sirmabus/IDA_FunctionStringAssociate_PlugIn.zip





Comments
Raindog Posted: Wednesday, May 14 2008 01:48.40 CDT
Why don't you write a script that will parse names such as:

"foo_t::bar() requires to be called this way"

rip the foo_t::bar() out, change it to foo_t__bar and rename the function?

I'm going to do that when I have the time.

Sirmabus Posted: Wednesday, May 14 2008 04:52.59 CDT
Ya, that's an idea.  I consider that, but the problem is a reference like that doesn't necessarily mean it's "foo_t::bar()".

Might still be useful to do that taking the assumption it's really the function all the time.
You could when the name set fails (assuming the name is taken) start appending with '_' then an a index number.
I.E. "foo_t::bar_0", "foo_t::bar_1" ... "foo_t::bar_99", etc.

FYI you don't need, and probably don't want to rename to "foo_t__bar".  IDA will accecpt "foo_t::bar" as a name, it will just display it as "foo_t__bar" for you..