Skip to content

Fixed: the return value truncated(32 bit) of get_name_value function that analyzed 64 bit binary file about ida64 for win, and etc #60

Merged
aquynh merged 72 commits into
keystone-engine:masterfrom
fjh658:master
Dec 11, 2018
Merged

Fixed: the return value truncated(32 bit) of get_name_value function that analyzed 64 bit binary file about ida64 for win, and etc #60
aquynh merged 72 commits into
keystone-engine:masterfrom
fjh658:master

Conversation

@fjh658
Copy link
Copy Markdown
Contributor

@fjh658 fjh658 commented Dec 11, 2018

  • Added debugging by pydevd
  • Added name with $, eg: jmp short $Done$
  • Updated Author Date 2016->2018
  • Updated MAX_INSTRUCTION_STRLEN to 256
  • Fixed: the return value truncated(32 bit) of get_name_value function that analyzed 64 bit binary file about ida64 for win

jianhua.fengjh and others added 30 commits August 1, 2017 21:45
…mpatible with ida pro 6, 7(beta);

for everyone is happy
…mpatible with ida pro 6, 7(beta);

for everyone is happy
…mpatible with ida pro 6, 7(beta);

for everyone is happy
…mpatible with ida pro 6, 7(beta);

for everyone is happy
* fixed inf no attribute "mf",   because ida pro beta 3 (170724)   renamed inf.is_mf()/set_mf() -> is_be()/set_be()

* fixed inf no attribute "mf",   because ida pro7 beta 3 (170724)   renamed inf.is_mf()/set_mf() -> is_be()/set_be()

* Add ida pro version check, about be(big endian)

* Since ida pro7 beta 3 (170724) renamed inf.mf -> is_be()/set_be(),  Compatible with ida pro 6, 7(beta);
for everyone is happy
fjh658 and others added 27 commits September 6, 2017 13:15
2. Added name with $, eg: jmp     short $Done$
3. Updated Author Date 2016->2018
4. Updated MAX_INSTRUCTION_STRLEN to 256
5. Fixed: the return value truncated(32 bit) of get_name_value function that analyzed 64 bit binary file about ida64 for win
@fjh658
Copy link
Copy Markdown
Contributor Author

fjh658 commented Dec 11, 2018

Please PR review, I tested for ida 6.x, ida7.x. @aquynh
Official ida will be fixed in 7.3 about this get_name_value issue. Workarounds currently in use.

def get_name_value(_from, name):
    """
    Fixed: the return value truncated(32 bit) of get_name_value function that analyzed 64 bit binary file about ida64 for win.

    eg:
    type == idaapi.NT_BYTE
    (type, value) = idaapi.get_name_value(idc.BADADDR, "wcschr") # ida64 for win

    value = 0x14003d3f0L is correct  ida64 > 7.x for macOS
    value = 0x4003d3f0L is truncated ida64 >= 6.x for win, ida64 == 6.x for macOS

    :param _from: ea
    :param name: name string
    :return: tuple
    """
    (type, value) = idaapi.get_name_value(_from, name)
    if type == idaapi.NT_BYTE:  # type is byte name (regular name)
        value = idaapi.get_name_ea(_from, name)
    return (type, value)

@aquynh aquynh merged commit 581e9b6 into keystone-engine:master Dec 11, 2018
@aquynh
Copy link
Copy Markdown
Member

aquynh commented Dec 11, 2018

merged, thanks!

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants