62
« on: April 12, 2013, 02:49:15 PM »
I made a small python code which will guess func name from IDA decompiled text.
Currently only phase one guessing method implemented.
this code automatically guess funcname and output a IDA script.
Current result is
Total func converted = 1258/18275
python code is
# coding=utf-8
import sys
import re
argvs = sys.argv
argc = len(argvs)
def parseDryDbgMsg(strFname,strCode,dicParams):
lstCode1 = strCode.split('"')
if(len(lstCode1) < 2):
return ""
strRet = ""
lstRet = []
lstCode = lstCode1[1].split(" ")
#parse all lines
for strT in lstCode:
if(len(strT) == 0): continue;
if(re.match('.*\\%',strT) != None): continue;
if(re.match(":",strT) != None): continue;
if(re.match("<-",strT) != None): continue;
if(re.match("->",strT) != None): continue;
if(re.match("ERR",strT) != None): continue;
if(re.match("#",strT) != None): continue;
if(re.match("!",strT) != None): continue;
if(re.match("=",strT) != None): continue;
if(re.match("\\(",strT) != None): continue;
if(re.match("\\)",strT) != None): continue;
if(re.match("^.*\\.c",strT) != None): continue;
if(re.match("Unknown",strT) != None): continue;
if(re.match(">",strT) != None): continue;
if(re.match("<",strT) != None): continue;
if(re.match("\\+",strT) != None): continue;
if(re.match("\\@",strT) != None): continue;
if(re.match("\\\n",strT) != None): continue;
strT = re.sub("\\*+","",strT)
strT = re.sub(":","",strT)
strT = re.sub("\\(","",strT)
strT = re.sub("\\)","",strT)
strT = re.sub("\\.+","",strT)
strT = re.sub("\\,","",strT)
strT = re.sub("-+","",strT)
strT = re.sub("\\[","",strT)
# print strT
if(len(strT)):
if(re.search("]",strT) != None):
strT = re.sub("]","_",strT);
strRet = strRet + strT
else:
strRet = strRet + strT
strRet = strRet + " ";
#parse result
lstRet = strRet.split(" ")
for strParam in lstRet:
if(len(strParam)):
if strParam in dicParams:
dicParams[strParam] = dicParams[strParam] + 1
# print "%s %s " % (dicParams[strParam],strParam)
else:
dicParams[strParam] = 1;
def PrepareFuncCode(lstFuncCode):
#get original funcname
lstLine = lstFuncCode[0].split('(');
strFname = re.sub("^.* ","",lstLine[0])
if(len(strFname) == 0): return
# print strFname
dicParams = {}
for strCode in lstFuncCode:
if(strCode.find('DryosDebugMsg') != -1):
parseDryDbgMsg(strFname,strCode,dicParams);
#find most counted key
strNFname = "";
intCount = 0;
for k, v in dicParams.items():
if(intCount < v):
strNFname = k
intCount = v
if(len(strNFname) < 8):
return
# print "%s %s " % (dicParams[strNFname],strNFname)
#Dsiplay result
if(intCount > 1):
print "MakeName(%s,%s);" % (strFname,strNFname)
return 1
return 0
def main(argvs,argc):
intFuncnum = 0
intPrevfuncnum = 0
lstFunc = list()
strFname = ""
intConvNum = 0;
#read lines
for strLine in open(argvs[1], 'r'):
#Split each funcs
if(strLine.find("//----- ") != -1):
intFuncnum = intFuncnum + 1
if(intPrevfuncnum < intFuncnum): #enter newfunc
if(len(lstFunc)):
# print lstFunc
if(PrepareFuncCode(lstFunc)):
intConvNum = intConvNum + 1
del lstFunc[:]
bFirstLine = 1
intPrevfuncnum = intFuncnum
else:
if(intFuncnum >=1):
lstFunc.append(strLine)
print "Total func converted = %d/%d" % (intConvNum,intFuncnum)
main(argvs,argc)