keystone-engine / keypatch

Multi-architecture assembler for IDA Pro. Powered by Keystone Engine.
http://www.keystone-engine.org/keypatch
GNU General Public License v2.0
1.47k stars 355 forks source link

Fixed: the return value truncated(32 bit) of get_name_value function that analyzed 64 bit binary file about ida64 for win, and etc #60

Closed fjh658 closed 5 years ago

fjh658 commented 5 years ago
fjh658 commented 5 years ago

Please PR review, I tested for ida 6.x, ida7.x. @aquynh Official ida will be fixed in 7.3 about this get_name_value issue. Workarounds currently in use.

def get_name_value(_from, name):
    """
    Fixed: the return value truncated(32 bit) of get_name_value function that analyzed 64 bit binary file about ida64 for win.

    eg:
    type == idaapi.NT_BYTE
    (type, value) = idaapi.get_name_value(idc.BADADDR, "wcschr") # ida64 for win

    value = 0x14003d3f0L is correct  ida64 > 7.x for macOS
    value = 0x4003d3f0L is truncated ida64 >= 6.x for win, ida64 == 6.x for macOS

    :param _from: ea
    :param name: name string
    :return: tuple
    """
    (type, value) = idaapi.get_name_value(_from, name)
    if type == idaapi.NT_BYTE:  # type is byte name (regular name)
        value = idaapi.get_name_ea(_from, name)
    return (type, value)
aquynh commented 5 years ago

merged, thanks!