deresz / funcap

IDA Pro script to add some useful runtime info to static analysis
523 stars 93 forks source link

function prototype determination to cast arguments #3

Open deresz opened 11 years ago

deresz commented 11 years ago

Instead of simple arg frame size calculation (get_num_args_stack()) and argument primitive type guessing (only string and int) - we could read function prototypes guessed by IDA, or even HexRays decompiler plugin, and cast arguments at them. For API calls we could use some info from underlying debugging symbols. This seem cool but it's lot of work and it should be experimentally verified first if it would work at all.