Closed anthonyprintup closed 2 years ago
Added support for IDA 8.0 by using ida_enum.get_enum_member_by_name
to check for enum names.
I've only tested the plugin on two samples (one 32-bit and one 64-bit). Strings with invalid names (e.g. -path) haven't been tested yet, but should work (look at https://github.com/OALabs/hashdb-ida/pull/31).
Confirmed to be working properly in all instances. All tests passed (IDA 8.0, Python 3.10.6) and ready to merge.
This PR fixes issue #34.
Detailed description:
ida_typeinf
for typeinf related APIs,get_existing_enum_values
which checks if an enum already exists and parses its values using the IDA API (ida_typeinf.get_named_type, ida_typeinf.idc_print_type),add_enums
will now check for existing enum values before parsing the provided hash list,add_enums
now manually corrects strings with dots in their names (e.g.ntdll.dll
->ntdll_dll
),add_enums
now usesida_name.get_name_ea
to check if a name already exists in the database (previously usedida_enum.add_enum_member
which checked this automatically)add_enums
no longer expects a 3rd function parameter because the enum size now depends on the database type or the algorithm size (64-bit databases will always generate 64-bit enums),add_enums
: replaced the method used when creating an enum (massive performance improvements); using ida_typeinf.idc_parse_types and ida_typeinf.import_type.Possible (but unlikely) bugs:
get_existing_enum_values
will not parse values properly on expected integer bases (e.g. if for some reason the values aren't in decimal or hexadecimal form),ida_enum.add_enum_member
to append enum members we lose some internal corrections that IDA performs on the enum names (e.g. replacing dots with underscores); this has to be corrected manually from now on.Disclaimer:
I've only tested the plugin on two samples (one 32-bit and one 64-bit). Strings with invalid names (e.g.
-path
) haven't been tested yet, but should work (look at #31). TLDR; more testing required before we can push a release.