IDCScripts/parseFunctionType.idc at main · Auskren/IDCScripts · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
static main() // main has to be changed for different binaries depending on used obfuscation method and used registers for calls.
{
    auto ea;
    ea = read_dbg_dword(ebx); // start address of the function

    auto func_name;
    func_name = get_name(ea);
    msg("Function name: %s\n", func_name);

    auto func_type;
    func_type = get_type(ea);
    if (func_type)
    {
        msg("Function type: %s\n", func_type);
        parse_function_type(ea, func_type);
    }
    else
    {
        msg("Unable to get function type.\n");
    }
}

static parse_function_type(ea, type_str)
{
    auto args_start, args_end;
    args_start = strstr(type_str, "(");
    args_end = strstr(type_str, ")");

    if (args_start && args_end)
    {
        args_start++;
        auto args_str;
        args_str = substr(type_str, args_start - type_str, args_end - args_start);

        auto args;
        args = split(args_str, ',');

        for (auto i = 0; i < GetType(ea); i++)
        {
            auto arg_name;
            arg_name = GetMemberName(GetFirstMember(ea, i));

            if (arg_name == "")
            {
                arg_name = "unknown";
            }

            msg("Parameter %d: %s %s\n", i + 1, args[i], arg_name);
        }
    }
    else
    {
        msg("No parameters found.\n");
    }
}

static split(s, delim)
{
    auto result;
    result = object();

    auto start, end;
    start = 0;
    while (start < strlen(s))
    {
        end = strstr(s + start, delim);
        auto token;
        if (end)
        {
            token = substr(s, start, end - (s + start));
            start = end - s + 1;
        }
        else
        {
            token = substr(s, start, strlen(s) - start);
            start = strlen(s);
        }

        result[sizeof(result)] = token;
    }

    return result;
}