Skip to content

README.md

Latest commit

 

History

History
32 lines (21 loc) · 1023 Bytes

README.md

File metadata and controls

32 lines (21 loc) · 1023 Bytes
Raw

Function String Associate Extra

Stripped binary? This fills in the blanks.

  1. Drops referenced strings into function comments as #STR: "foo", "bar" - so you know what sub_101EFF40 does without opening it.
  2. Pulls real names out of 32-bit MSVC exception handlers and renames functions. For example, on a Lineage 2 client it recovered ~2000 names per DLL.

Before:

int __thiscall sub_101EFF40(void *this, int a2, int a3)

After:

// #STR: "param1", "param2"
int __thiscall NSystemMessageManager::AddSystemMessageParam(...)

Install

Just drop FunctionStringAssociateExtra.py into IDA plugins/ folder:

  • Windows: %APPDATA%\Hex-Rays\IDA Pro\plugins
  • Linux / macOS: ~/.idapro/plugins

Run

Wait for auto-analysis to finish first then run Edit -> Plugins -> Function String Associate Extra.

Rename only touches sub_* / loc_* - real names are never overwritten. Renaming needs 32-bit MSVC, commenting works everywhere.

Commenting logic based on plugin by Sirmabus and oxiKKK <3