// Returns a pretty factional byte size string for given input size
LPCSTR byteSizeString(UINT64 bytes)
{
static const UINT64 KILLOBYTE = 1024;
static const UINT64 MEGABYTE = (KILLOBYTE * 1024); // 1048576
static const UINT64 GIGABYTE = (MEGABYTE * 1024); // 1073741824
static const UINT64 TERABYTE = (GIGABYTE * 1024); // 1099511627776
#define BYTESTR(_Size, _Suffix) \
{ \
double fSize = ((double) bytes / (double) _Size); \
double fIntegral; double fFractional = modf(fSize, &fIntegral); \
if(fFractional > 0.05) \
_snprintf(buffer, SIZESTR(buffer), ("%.1f " ## _Suffix), fSize); \
else \
_snprintf(buffer, SIZESTR(buffer), ("%.0f " ## _Suffix), fIntegral); \
}
static char buffer[32];
ZeroMemory(buffer, sizeof(buffer));
if (bytes >= TERABYTE)
BYTESTR(TERABYTE, "TB")
else
if (bytes >= GIGABYTE)
BYTESTR(GIGABYTE, "GB")
else
if (bytes >= MEGABYTE)
BYTESTR(MEGABYTE, "MB")
else
if (bytes >= KILLOBYTE)
BYTESTR(KILLOBYTE, "KB")
else
_snprintf(buffer, SIZESTR(buffer), "%u byte%c", bytes, (bytes == 1) ? 0 : 's');
return(buffer);
}
// Get a pretty delta time string for output
LPCSTR timeString(TIMESTAMP time)
{
static char szBuff[64];
if(time >= HOUR)
_snprintf(szBuff, SIZESTR(szBuff), "%.2f hours", (time / (TIMESTAMP) HOUR));
else
if(time >= MINUTE)
_snprintf(szBuff, SIZESTR(szBuff), "%.2f minutes", (time / (TIMESTAMP) MINUTE));
else
if(time < (TIMESTAMP) 0.01)
_snprintf(szBuff, SIZESTR(szBuff), "%.2f milliseconds", (time * (TIMESTAMP) 1000.0));
else
_snprintf(szBuff, SIZESTR(szBuff), "%.2f seconds", time);
return(szBuff);
}
// Output formated text to debugger channel
void trace(const char *format, ...)
{
if (format)
{
va_list vl;
char str[4096]; str[SIZESTR(str)] = 0;
va_start(vl, format);
_vsntprintf(str, (sizeof(str) - 1), format, vl);
va_end(vl);
OutputDebugString(str);
}
}
// Plug-in process
void CORE_Process(int iArg)
{
try
{
char version[16];
sprintf(version, "%u.%u", HIBYTE(MY_VERSION), LOBYTE(MY_VERSION));
msg("\n>> WhatAPIs: v: %s, built: %s, By Sirmabus\n", version, __DATE__);
if (!autoIsOk())
{
msg("** Must wait for IDA to finish processing before starting plug-in! **\n*** Aborted ***\n\n");
return;
}
// Show UI
refreshUI();
int uiResult = AskUsingForm_c(mainDialog, version, doHyperlink);
if (!uiResult)
{
msg(" - Canceled -\n");
return;
}
WaitBox::show();
TIMESTAMP startTime = getTimeStamp();
// Build import segment bounds table
{
msg("Import segments:\n");
refreshUI();
SEGLIST segList;
for (int i = 0; i < get_segm_qty(); i++)
{
if (segment_t *s = getnseg(i))
{
if (s->type == SEG_XTRN)
{
char buffer[64] = { "unknown" }; buffer[SIZESTR(buffer)] = 0;
get_true_segm_name(s, buffer, SIZESTR(buffer));
msg(" [%d] \"%s\" "EAFORMAT" - "EAFORMAT"\n", segmentCount, buffer, s->startEA, s->endEA);
BOUNDS b = { s->startEA, s->endEA };
segList.push_back(b);
segmentCount++;
}
}
}
refreshUI();
// Flatten list into an array for speed
if (segmentCount)
{
UINT size = (segmentCount * sizeof(BOUNDS));
if (segmentPtr = (BOUNDS *)_aligned_malloc(size, 16))
{
BOUNDS *b = segmentPtr;
for (SEGLIST::iterator i = segList.begin(); i != segList.end(); i++, b++)
{
b->startEA = i->startEA;
b->endEA = i->endEA;
}
}
else
{
msg("\n*** Allocation failure of %u bytes! ***\n", size);
refreshUI();
}
}
}
if (segmentCount)
{
// Make a list of all import names
if (int moduleCount = get_import_module_qty())
{
for (int i = 0; i < moduleCount; i++)
enum_import_names(i, importNameCallback);
char buffer[32];
msg("Parsed %s module imports.\n", prettyNumberString(moduleCount, buffer));
refreshUI();
}
// Iterate through all functions..
BOOL aborted = FALSE;
UINT functionCount = get_func_qty();
char buffer[32];
msg("Processing %s functions.\n", prettyNumberString(functionCount, buffer));
refreshUI();
for (UINT n = 0; n < functionCount; n++)
{
processFunction(getn_func(n));
if (WaitBox::isUpdateTime())
{
if (WaitBox::updateAndCancelCheck((int)(((float)n / (float)functionCount) * 100.0f)))
{
msg("* Aborted *\n");
break;
}
}
}
refresh_idaview_anyway();
WaitBox::hide();
msg("\n");
msg("Done. %s comments add/appended in %s.\n", prettyNumberString(commentCount, buffer), timeString(getTimeStamp() - startTime));
msg("-------------------------------------------------------------\n");
}
else
msg("\n*** No import segments! ***\n");
if (segmentPtr)
{
_aligned_free(segmentPtr);
segmentPtr = NULL;
}
apiMap.clear();
}
CATCH()
}
// Process function
void processFunction(func_t *f)
{
// Skip tiny functions
if(f->size() >= 5)
{
// Don't add comments to API wrappers
char name[MAXNAMELEN]; name[0] = name[SIZESTR(name)] = 0;
if(!apiMap.empty())
{
if(get_short_name(BADADDR, f->startEA, name, SIZESTR(name)))
{
if(apiMap.find(name) != apiMap.end())
return;
}
}
// Iterate function body
STRLIST importLstTmp;
LPSTR commentPtr = NULL;
char comment[MAXSTR]; comment[0] = comment[SIZESTR(comment)] = 0;
UINT commentLen = 0;
#define ADDNM(_str) { UINT l = strlen(_str); memcpy(comment + commentLen, _str, l); commentLen += l; _ASSERT(commentLen < MAXSTR); }
func_item_iterator_t it(f);
do
{
ea_t currentEA = it.current();
// Will be a "to" xref
xrefblk_t xb;
if(xb.first_from(currentEA, XREF_FAR))
{
BOOL isImpFunc = FALSE;
name[0] = 0;
// If in import segment
// ============================================================================================
ea_t refAdrEa = xb.to;
if(isInImportSeg(refAdrEa))
{
flags_t flags = get_flags_novalue(refAdrEa);
if(has_name(flags) && hasRef(flags) && isDwrd(flags))
{
if(get_short_name(BADADDR, refAdrEa, name, SIZESTR(name)))
{
// Nix the imp prefix if there is one
if(strncmp(name, "__imp_", SIZESTR("__imp_")) == 0)
memmove(name, name + SIZESTR("__imp_"), ((strlen(name) - SIZESTR("__imp_")) + 1));
isImpFunc = TRUE;
}
else
msg(EAFORMAT" *** Failed to get import name! ***\n", refAdrEa);
}
}
// Else, check for import wrapper
// ============================================================================================
else
if(!apiMap.empty())
{
// Reference is a function entry?
flags_t flags = get_flags_novalue(refAdrEa);
if(isCode(flags) && has_name(flags) && hasRef(flags))
{
if(func_t *refFuncPtr = get_func(refAdrEa))
{
if(refFuncPtr->startEA == refAdrEa)
{
if(get_short_name(BADADDR, refAdrEa, name, SIZESTR(name)))
{
// Skip common unwanted types "sub_.." or "unknown_libname_.."
if(
// not "sub_..
/*"sub_"*/ (*((PUINT) name) != 0x5F627573) &&
// not "unknown_libname_..
/*"unknown_"*/ ((*((PUINT64) name) != 0x5F6E776F6E6B6E75) && (*((PUINT64) (name + 8)) != /*"libname_"*/ 0x5F656D616E62696C)) &&
// not nullsub_..
/*"nullsub_"*/ (*((PUINT64) name) != 0x5F6275736C6C756E)
)
{
// Nix the import prefixes
if(strncmp(name, "__imp_", SIZESTR("__imp_")) == 0)
memmove(name, name + SIZESTR("__imp_"), ((strlen(name) - SIZESTR("__imp_")) + 1));
// Assumed to be a wrapped import if it's in the list
isImpFunc = (apiMap.find(name) != apiMap.end());
}
}
else
msg(EAFORMAT" *** Failed to get function name! ***\n", refAdrEa);
}
}
}
}
// Found import function to add list
if(isImpFunc)
{
// Skip those large common STL names
if(strncmp(name, "std::", SIZESTR("std::")) != 0)
{
// Skip if already seen in this function
BOOL known = FALSE;
for(STRLIST::iterator ji = importLstTmp.begin(); ji != importLstTmp.end(); ji++)
{
if(strcmp(ji->c_str(), name) == 0)
{
known = TRUE;
break;
}
}
// Not seen
if(!known)
{
importLstTmp.push_front(name);
// Append to existing comments w/line feed
if(!commentLen && !commentPtr)
{
commentPtr = get_func_cmt(f, true);
if(!commentPtr)
get_func_cmt(f, false);
if(commentPtr)
{
commentLen = strlen(commentPtr);
// Bail out not enough comment space
if(commentLen >= (MAXSTR - 20))
{
qfree(commentPtr);
return;
}
memcpy(comment, commentPtr, commentLen);
ADDNM("\n"MYTAG);
}
}
if(!commentLen)
ADDNM(MYTAG);
// Append a "..." (continuation) and bail out if name hits max comment length
if((commentLen + strlen(name) + SIZESTR("()") + sizeof(", ")) >= (MAXSTR - sizeof("...")))
{
ADDNM(" ...");
break;
}
// Append this function name
else
{
if(importLstTmp.size() != 1)
ADDNM(", ");
ADDNM(name); ADDNM("()");
}
}
}
else
{
//msg("%s\n", szName);
}
}
}
}while(it.next_addr());
if(!importLstTmp.empty() && commentLen)
{
// Add comment
comment[commentLen] = 0;
set_func_cmt(f, comment, true);
commentCount++;
}
if(commentPtr)
qfree(commentPtr);
}
}
