Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Feature Request: Auto Create Struct for Consecutive Functions/Hashes #50

Open
emtuls opened this issue May 8, 2024 · 0 comments
Open

Comments

@emtuls
Copy link

emtuls commented May 8, 2024

Hello! Thank you for this plugin as I find it very useful. I wanted to suggest a feature that I think may be useful and hopefully not too difficult to add.

Sometimes there are a lot of hashes near each other that can be resolved in a single swoop, which you have noted and created the ability to resolve all of them, which is really nice. But when these get used in malware, there is often an API_Struct of a sort that gets passed around using them. It would be nice to be able to have a struct that is generated that contains the resolved functions so that it can be applied to where this occurs.

An example can be seen towards the middle/bottom of this blog post where it talks about Create Struct: https://www.mandiant.com/resources/blog/precalculated-string-hashes-reverse-engineering-shellcode

This does not need to be anything beyond a simple struct with names, but an addition that could improve it even further might be something like incorporating the function prototypes for each resolved function so that the arguments can be populated as comments. This can sort of be seen in this blog post here about an IDA Plugin called StructTyper: https://www.mandiant.com/resources/blog/function-prototypes-indirect-calls

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant