Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Automatically convert constant into enum in IDA pseudocode view #1

Open
herrcore opened this issue Sep 24, 2021 · 2 comments
Open

Automatically convert constant into enum in IDA pseudocode view #1

herrcore opened this issue Sep 24, 2021 · 2 comments
Assignees
Labels
enhancement New feature or request ida-plugin

Comments

@herrcore
Copy link
Member

I'm not sure how to use ida python to convert a constant to an enum in the IDA pseudocode view... easy enough to do in the disassembly view but I'm not sure how to find the constant in the decompiled code?

Help appreciated 🙏

@herrcore herrcore added the enhancement New feature or request label Sep 24, 2021
@herrcore herrcore self-assigned this Sep 24, 2021
@cr3m
Copy link

cr3m commented Oct 27, 2021

Hello,

You can using CTree to extract arguments which is hash number from resolve function (better if this function is renamed) then using this pseudo-code to set enum symbol for them:

def get_enum(constant):
    all_enums = ida_enum.get_enum_qty()
    for i in range(0, all_enums):
        enum_id = ida_enum.getn_enum(i)
        enum_constant = ida_enum.get_first_enum_member(enum_id, idaapi.DEFMASK)
        name = ida_enum.get_enum_member_name(ida_enum.get_enum_member(enum_id, enum_constant, 0, idaapi.DEFMASK))
        if int(enum_constant) == constant: return [name, enum_id]
        while True:
            enum_constant = ida_enum.get_next_enum_member(enum_id, enum_constant, idaapi.DEFMASK)
            name = ida_enum.get_enum_member_name(ida_enum.get_enum_member(enum_id, enum_constant, 0, idaapi.DEFMASK))
            if enum_constant == idaapi.DEFMASK:
                break
            if int(enum_constant) == constant: return [name, enum_id]
    return None

def enum_symbolic_const(cfunc, xref_args):
    for arg_ea in xref_args:
        ea_addr = arg_ea.keys()[0]
        constant = arg_ea[ea_addr]
        enum_data = get_enum(constant)
        if enum_data is not None:
            name, enum_id = enum_data
            op_num = 1     # because instruction is: mov ecx, 0E58BCD71h
            ida_bytes.op_enum(ea_addr, op_num, enum_id, 0)

Hope it helps

@cr3m
Copy link

cr3m commented Oct 27, 2021

Or we can add all values in only one enum type declaration and set type of hash value in resolving function to that enum type.

herrcore pushed a commit that referenced this issue Nov 2, 2021
Added iterative enum name suffixes - TODO: fix up code
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
enhancement New feature or request ida-plugin
Projects
None yet
Development

No branches or pull requests

2 participants