#include //Microsoft C++ RTTI support for IDA //Version 3.0 2006.01.20 Igor Skochinsky //#define DEBUG ////////////////////////////////////// // Unknown(long ea, long length) ////////////////////////////////////// // Mark the ea as unknown for a length // of length, but don't propagate. static Unknown( ea, length ) { auto i; if (ea==BADADDR) return; // Message("Unknown(%x,%d)\n",ea, length); for(i=0; i < length; i++) { MakeUnkn(ea+i,0); } } static ForceQword( x ) { //Make dword, undefine as needed if (x==BADADDR || x==0) return; if (!MakeQword( x )) { Unknown(x,8); MakeQword(x); } } static ForceDword( x ) { //Make dword, undefine as needed if (x==BADADDR || x==0) return; if (!MakeDword( x )) { Unknown(x,4); MakeDword(x); } } static ForceWord( x ) { //Make word, undefine as needed if (x==BADADDR || x==0) return; if (!MakeWord( x )) { Unknown(x,2); MakeWord( x ); } } static ForceByte( x ) { //Make byte, undefine as needed if (x==BADADDR || x==0) return; if (!MakeByte( x )) { MakeUnkn(x,0); MakeByte( x ); } } static SoftOff ( x ) { //Make offset if !=0 if (x==BADADDR || x==0) return; ForceDword(x); if (Dword(x)>0 && Dword(x)<=MaxEA()) OpOff(x,0,0); } static GetAsciizStr(x) { auto s,c; if (x==BADADDR || x==0) return ""; s = ""; while (c=Byte(x)) { s = form("%s%c",s,c); x = x+1; } return s; } //check if Dword(vtbl-4) points to typeinfo record and extract the type name from it static GetTypeName(vtbl) { auto x, s, c; if (vtbl==BADADDR) return; x = Dword(vtbl-4); if ((!x) || (x==BADADDR)) return ""; // if (Dword(x)||Dword(x+4)||Dword(x+8)) return ""; x = Dword(x+12); if ((!x) || (x==BADADDR)) return ""; s = ""; x = x+8; while (c=Byte(x)) { s = form("%s%c",s,c); x = x+1; } return s; } static DwordCmt(x, cmt) { if (x==BADADDR || x==0) return; ForceDword(x); MakeComm(x, cmt); } static OffCmt(x, cmt) { if (x==BADADDR || x==0) return; SoftOff(x); MakeComm(x, cmt); } static StrCmt(x, cmt) { auto save_str; if (x==BADADDR || x==0) return; MakeUnkn(x, 0); save_str = GetLongPrm(INF_STRTYPE); SetLongPrm(INF_STRTYPE,0); MakeStr(x, BADADDR); MakeName(x, ""); MakeComm(x, cmt); SetLongPrm(INF_STRTYPE,save_str); } static DwordArrayCmt(x, n, cmt) { if (x==BADADDR || x==0) return; Unknown(x,4*n); ForceDword(x); MakeArray(x,n); MakeComm(x, cmt); } //check if values match a pattern static matchBytes(addr,match) { auto i,len,s; len = strlen(match); if (len%2) { Warning("Bad match string in matchBytes: %s",match); return 0; } i=0; while (i0) { s = form("%c%s",'A'+x%16,s); x = x / 16; } return sign?"?":""+s+"@"; } } static Parse_BCD(x, indent) { auto indent_str,i,a,s; if (x==BADADDR || x==0) return; indent_str="";i=0; while(i0) //check numContainedBases DumpNestedClass(a+4, indent+1, n); //nested classes following a=a+4*(n+1); i=i+n+1; } } static Parse_CHD(x, indent) { auto indent_str,i,a,n,p,s; if (x==BADADDR || x==0) return; indent_str="";i=0; while(i ??0exception@@QAE@ABV0@@Z = exception::exception(exception const &) MakeName(Dword(x+24),"??0"+substr(s,4,-1)+"QAE@ABV0@@Z"); return s; } static Parse_CTA(x, indent) { /* typedef const struct _s__CatchableTypeArray { int nCatchableTypes; _CatchableType *arrayOfCatchableTypes[]; } _CatchableTypeArray; */ auto indent_str,i,a,n,p,s; if (x==BADADDR || x==0) return; indent_str="";i=0; while(i ??1exception@@UAE@XZ = exception::~exception(void) MakeName(Dword(x+4),"??1"+substr(s,4,-1)+"UAE@XZ"); i = Dword(x); //attributes a = DemangleTIName(s); if (i&1) a = "const "+a; if (i&2) a = "volatile "+a; a = "throw "+a; Message("%s\n",a); MakeRptCmt(x, a); } return s; } static Parse_TryBlock(x, indent) { /* typedef const struct _s_TryBlockMapEntry { int tryLow; //00 int tryHigh; //04 int catchHigh; //08 int nCatches; //0C const struct _s_HandlerType * pHandlerArray; //10 } TryBlockMapEntry; typedef const struct _s_HandlerType { unsigned int adjectives; //00 struct TypeDescriptor * pType; //04 int dispCatchObj; //08 void * addressOfHandler; //0C } */ auto indent_str,i,a,n,p,s; if (x==BADADDR || x==0) return; indent_str="";i=0; while(i0xF) { Message("Magic is not 1993052Xh!\n"); return; } indent_str="";i=0; while(i=32 || Dword(x)>0x19930520) { #ifdef DEBUG Message(indent_str+" pESTypeList: %08.8Xh\n", Dword(x+28)); #endif OffCmt(x+28, "pESTypeList"); } if ((Dword(x+8)-x)>=36 || Dword(x)>0x19930521) { #ifdef DEBUG Message(indent_str+" EHFlags: %08.8Xh\n", Dword(x+32)); #endif OffCmt(x+32, "EHFlags"); } return s; } //get class name for this vtable instance static GetVtableClass(x) { auto offset, n, i, s, a, p; offset = Dword(x+4); x = Dword(x+16); //Class Hierarchy Descriptor a=Dword(x+12); //pBaseClassArray n=Dword(x+8); //numBaseClasses i = 0; s = ""; while(i