def iterate_vtable(vtable_addr):
    ea = vtable_addr
    while True:
        fn_ea = struct.unpack('<Q', idaapi.get_bytes(ea, 8))[0]
        if idaapi.get_name(fn_ea) != "__cxa_pure_virtual" and not idaapi.is_func(idaapi.get_flags(fn_ea)):
            return
        yield fn_ea
        ea += 8
Beispiel #2
0
def has_all_vtable_functions_named(vtable_ea): # type: (int) -> bool
    ea = vtable_ea
    while True:
        function_ea = struct.unpack('<Q', idaapi.get_many_bytes(ea, 8))[0]
        if '__cxa_pure_virtual' not in idc.GetDisasm(function_ea) and not idaapi.is_func(idaapi.get_flags(function_ea)):
            break
        current_name = idc.GetFunctionName(function_ea)
        if current_name.startswith('sub_') or current_name.startswith('j_sub_'):
            return False
        ea += 8
    return True
Beispiel #3
0
def rename_vtable_functions(names, vtable_ea, class_name): # type: (typing.Dict[int, str], int, str) -> None
    ea = vtable_ea
    i = 0
    while True:
        function_ea = struct.unpack('<Q', idaapi.get_many_bytes(ea, 8))[0]
        if '__cxa_pure_virtual' not in idc.GetDisasm(function_ea) and not idaapi.is_func(idaapi.get_flags(function_ea)):
            break

        member_fn_name = names.get(i, "m%d" % i)
        function_name = "%s::%s" % (class_name, member_fn_name)
        current_name = idc.GetFunctionName(function_ea)
        if current_name.startswith('nullsub_') or current_name.startswith('j_nullsub_'):
            idc.MakeNameEx(function_ea, function_name + '_null', idaapi.SN_NOWARN)
        elif current_name.startswith('sub_') or \
            current_name.startswith("%s::m%d" % (class_name, i)) or \
            "runtimetypeinfo" in current_name.lower():
            idc.MakeNameEx(function_ea, function_name, idaapi.SN_NOWARN)
        i += 1
        ea += 8