Skip to content

About

IDA 9.X+ Function String Associate Extra Plugin

Resources

Stars

7 stars

Watchers

0 watching

Forks

Latest commit

 

History

1 Commit

Folders and files

NameName
Last commit message
Last commit date
 
 
 
 
 
 

Repository files navigation

Function String Associate Extra

Stripped binary? This fills in the blanks.

  1. Drops referenced strings into function comments as #STR: "foo", "bar" - so you know what sub_101EFF40 does without opening it.
  2. Pulls real names out of 32-bit MSVC exception handlers and renames functions. For example, on a Lineage 2 client it recovered ~2000 names per DLL.

Before:

int __thiscall sub_101EFF40(void *this, int a2, int a3)

After:

// #STR: "param1", "param2"
int __thiscall NSystemMessageManager::AddSystemMessageParam(...)

Install

Just drop FunctionStringAssociateExtra.py into IDA plugins/ folder:

  • Windows: %APPDATA%\Hex-Rays\IDA Pro\plugins
  • Linux / macOS: ~/.idapro/plugins

Run

Wait for auto-analysis to finish first then run Edit -> Plugins -> Function String Associate Extra.

Rename only touches sub_* / loc_* - real names are never overwritten. Renaming needs 32-bit MSVC, commenting works everywhere.

Commenting logic based on plugin by Sirmabus and oxiKKK <3

About

IDA 9.X+ Function String Associate Extra Plugin

Resources

Stars

7 stars

Watchers

0 watching

Forks

Releases

Packages

Contributors

Languages