def __can_be_part_of_assert(cfunc, ctree_item): # type: (idaapi.cfunc_t, idaapi.ctree_item_t) -> bool """ Returns true if expression we clicked is an argument passed to a function and this argument is a string that can be a valid function name """ if ctree_item.citype != idaapi.VDI_EXPR: return False expression = ctree_item.it.to_specific_type if expression.op != idaapi.cot_obj: return False parent = cfunc.body.find_parent_of(expression).to_specific_type if parent.op != idaapi.cot_call or parent.x.op != idaapi.cot_obj: return False obj_ea = expression.obj_ea if not helper.is_code_ea(obj_ea) and idc.get_str_type( obj_ea) == idc.STRTYPE_C: str_potential_name = idc.get_strlit_contents(obj_ea) if type(str_potential_name) is not str: # convert bytes to str (python 3) str_potential_name = str_potential_name.decode('ascii') return idaapi.is_valid_typename(str_potential_name) return False
def parse_vtable_name(address): name = idaapi.get_short_name(address) if idaapi.is_valid_typename(name): if name[0:3] == 'off': # off_XXXXXXXX case return "Vtable" + name[3:], False else: # Attempt to make nice and valid name from demangled RTTI name try: name = re.sub("^const ", "", name) sliced_names = name.split("::") name, for_part = "_for_".join(sliced_names[:-1]), sliced_names[-1] print name, for_part templates = re.search("<(.*)>", name) if templates: templates = templates.group(1) name = re.sub("<.*>", "", name) templates = re.sub("[^a-zA-Z0-9_*]", "_", templates) templates = re.sub("\*", "PTR", templates) name += '_' + templates for_part = re.search("\{for `(.*)'\}", for_part) if for_part: for_part = for_part.group(1) name += '_' + for_part return 'Vtable_' + name, True except (AttributeError, IndexError): print "[Warning] Unable to parse virtual table name - " return "Vtable_{0:X}".format(address), False
def __add_func_name(self, arg_expr): new_name = idc.get_strlit_contents(arg_expr.obj_ea) if not idaapi.is_valid_typename(new_name): logger.warn("Argument has a weird name `{}` at {}".format( new_name, helper.to_hex(helper.find_asm_address(arg_expr, self.parents)))) return self.__possible_names.add(new_name)
def __add_func_name(self, arg_expr): new_name = idc.get_strlit_contents(arg_expr.obj_ea) if type(new_name) is not str: # convert bytes to str (python 3) new_name = new_name.decode('ascii') if not idaapi.is_valid_typename(new_name): logger.warn("Argument has a weird name `{}` at {}".format( new_name, helper.to_hex(helper.find_asm_address(arg_expr, self.parents)))) return self.__possible_names.add(new_name)
def parse_vtable_name(address): name = idaapi.get_name(address) if idaapi.is_valid_typename(name): if name[0:3] == 'off': # off_XXXXXXXX case return "Vtable" + name[3:], False elif "table" in name: return name, True print "[Warning] Weird virtual table name -", name return "Vtable_" + name, False name = idc.demangle_name(idaapi.get_name(address), idc.INF_SHORT_DN) assert name, "Virtual table must have either legal c-type name or mangled name" return common.demangled_name_to_c_str(name), True
def parse_vtable_name(address): name = idaapi.get_name(address) if idaapi.is_valid_typename(name): if name[0:3] == 'off': # off_XXXXXXXX case return "Vtable" + name[3:], False elif "table" in name: return name, True print("[Warning] Weird virtual table name -", name) return "Vtable_" + name, False name = idc.demangle_name(idaapi.get_name(address), idc.get_inf_attr(idc.INF_SHORT_DN)) assert name, "Virtual table must have either legal c-type name or mangled name" return demangled_name_to_c_str(name).replace("const_", "").replace( "::_vftable", "_vtbl"), True
def name(self): name = idaapi.get_name(self.address) if idaapi.is_valid_typename(name): return name name = idc.demangle_name(name, idc.get_inf_attr(idc.INF_SHORT_DN)) return common.demangled_name_to_c_str(name)