Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

improve handling _ prefix added to library functions as compile/link artifact #924

Merged
merged 7 commits into from
Mar 25, 2022

Conversation

mike-hunhoff
Copy link
Collaborator

@mike-hunhoff mike-hunhoff commented Mar 23, 2022

fixes #923

Copy link

@github-actions github-actions bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Please add bug fixes, new features, breaking changes and anything else you think is worthwhile mentioning to the master (unreleased) section of CHANGELOG.md. If no CHANGELOG update is needed add the following to the PR description: [x] No CHANGELOG update needed

@github-actions github-actions bot dismissed their stale review March 23, 2022 17:40

CHANGELOG updated or no update needed, thanks! 😄

@mike-hunhoff mike-hunhoff changed the title remove _ prefix from library functions identified using FLIRT improve handling _ prefix added to library functions as compile/link artifact Mar 25, 2022
@@ -152,6 +152,8 @@ def extract_file_function_names():
if idaapi.get_func(ea).flags & idaapi.FUNC_LIB:
name = idaapi.get_name(ea)
yield FunctionName(name), ea
if name.startswith("_"):
yield FunctionName(name[1:]), ea
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

name[1:] vs name.lstrip("_")

one removes all prefixes, the other removes exactly one. can you confirm a final time this is what we want?

also, recommend including a comment here explaining what we're handling.

Copy link
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I'm basing this updated logic on how functions are defined by MSDN. We want to remove exactly one _ as there are functions defined with a leading _ e.g. _wfopen (https://docs.microsoft.com/en-us/cpp/c-runtime-library/reference/fopen-wfopen?view=msvc-170). In the case of _wfopen the linker may prefix as __wfopen. Using the logic mentioned here we would emit both _wfopen and __wfopen. wfopen is not defined by MSDN therefore it should not be emitted.

Copy link
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This assumes the _ prefix is always added (my understanding).

Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

perfect, thanks!

Copy link
Collaborator

@williballenthin williballenthin left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

see suggested comments (can merge from gh ui) and otherwise looks great!

mike-hunhoff and others added 4 commits March 25, 2022 13:04
Co-authored-by: Willi Ballenthin <willi.ballenthin@gmail.com>
Co-authored-by: Willi Ballenthin <willi.ballenthin@gmail.com>
Co-authored-by: Willi Ballenthin <willi.ballenthin@gmail.com>
Co-authored-by: Willi Ballenthin <willi.ballenthin@gmail.com>
@mike-hunhoff mike-hunhoff merged commit fb34b16 into master Mar 25, 2022
@mike-hunhoff mike-hunhoff deleted the fix/923 branch March 25, 2022 19:34
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

handle _ prefix added to library functions as compile/link artifact
3 participants