IDA script / plugin

[violentmagician]

Hi reversers.
i am trying to get to learn reversing ..very basic atm..
i have seen many posts by cypher and others which list lua callback addresses like
[Only registered and activated users can see links. ]

and it says

This is a dump of all the LUA callbacks for WoW v3.0.9.

I had to write a dumper for two reasons.

1. So I could generate a complete list of all the callbacks to import into IDA with a script.
2. Because I noticed certain LUA calls had different callbacks (and different output) depending on when they were executed (one for the login process, another for once you're ingame).
3. I wanted 'better' output. The one I wrote dumps in alphabetical order, strips duplicates, and has support for callbacks registered with multiple pointers.

the question i ask is can i please get the name and/or link of the IDA script that you use to import the dump into ida?

[ggg898]

Gamedeception has a bunch

[schlumpf]

As far as I know, GD has the one searching for "Usage: ". That one is bad.

You better get a lua function and then search for the list, the function is referenced in. That list is referenced in a function and then pushed entry by entry into the RegisterFunction function. You then take that one and search for all cross references. Take the lists pushed into the function and rename the functions there. That will give you all functions (except the ones of the widget API afaik).

A source in IDC for this approach is here:

#include <idc.idc>

// RegisterFunction(): 0x0077D290

static getRegisterFunction()
{
	auto dwAddress, str;
	dwAddress = FindBinary( dwAddress + 1, SEARCH_DOWN|SEARCH_NEXT, "\"Usage: SetCharCustomizeFrame\"" );
	dwAddress = DfirstB( DfirstB( PrevFunction( DfirstB( dwAddress ) ) ) ) + 0xE;
	str = GetOpnd ( dwAddress,0 );
	
	if (strstr(str,"sub_") == -1)
		return -1;
		
	str = substr(str,4,strlen(str));
	Message( "str = x%x.\n", xtol(str) );
	
	return (xtol(str));
}


static main()
{
	auto dwAddress, nameptr, maxentries;
	auto dwRegisterFunction; 
	auto name,fname, i;
	dwRegisterFunction = getRegisterFunction();
	Message( "dwRegisterFunction = x%x.\n", dwRegisterFunction );
	if( dwRegisterFunction == -1 )
		return;
		
	dwAddress = 0;
	
	while ( dwAddress != BADADDR )
	{
		dwAddress = RnextB ( dwRegisterFunction, dwAddress );  
		nameptr = GetNamesPtrFromAdr( dwAddress );
		maxentries = Dword( dwAddress + 0xD );
		for (i=0;i<maxentries/8;i++)
		{
			name = GetString( Dword(nameptr), -1, ASCSTR_C );
		
			if(strlen(name) < 4)
				break;
			fname = "Unknown::LUA::" + name;
						
			if ( RenameFunc( Dword(nameptr+4), fname ) == 0 )
				break;
			nameptr = nameptr + 8;
		}
	}
	Message( "Done." );
}

static GetNamesPtrFromAdr( adr )
{
	auto dwRet;
	dwRet = adr - 0x10 + 0x4;
	return ( Dword( dwRet ) - 4 );
}

// 1 = Success, 0 = Failure
static RenameFunc( dwAddress, sFunction )
{
	auto dwRet;

	dwRet = MakeNameEx( dwAddress, sFunction, SN_NOCHECK );

	if( dwRet == 0 )
	{
		auto sTemp, i;
		for( i = 0; i < 32; i++ )
		{
			sTemp = form( "%s_%i", sFunction, i );

			if( ( dwRet = MakeNameEx( dwAddress, sTemp, SN_NOCHECK ) ) != 0 )
			{
				Message( "Info: Renamed to %s instead of %s\n", sTemp, sFunction );
				break;
			}
		}
	}
	return dwRet;	
}

Feel free to use it. ; D

[violentmagician]

thanx this is helpful... i can now finally reverse lua on my own and understand what to use in those codecaves!
any other scripts that you guys recommend?

Originally Posted by schlumpf

As far as I know, GD has the one searching for "Usage: ". That one is bad.

You better get a lua function and then search for the list, the function is referenced in. That list is referenced in a function and then pushed entry by entry into the RegisterFunction function. You then take that one and search for all cross references. Take the lists pushed into the function and rename the functions there. That will give you all functions (except the ones of the widget API afaik).

A source in IDC for this approach is here:

#include <idc.idc>

// RegisterFunction(): 0x0077D290

static getRegisterFunction()
{
	auto dwAddress, str;
	dwAddress = FindBinary( dwAddress + 1, SEARCH_DOWN|SEARCH_NEXT, "\"Usage: SetCharCustomizeFrame\"" );
	dwAddress = DfirstB( DfirstB( PrevFunction( DfirstB( dwAddress ) ) ) ) + 0xE;
	str = GetOpnd ( dwAddress,0 );
	
	if (strstr(str,"sub_") == -1)
		return -1;
		
	str = substr(str,4,strlen(str));
	Message( "str = x%x.\n", xtol(str) );
	
	return (xtol(str));
}


static main()
{
	auto dwAddress, nameptr, maxentries;
	auto dwRegisterFunction; 
	auto name,fname, i;
	dwRegisterFunction = getRegisterFunction();
	Message( "dwRegisterFunction = x%x.\n", dwRegisterFunction );
	if( dwRegisterFunction == -1 )
		return;
		
	dwAddress = 0;
	
	while ( dwAddress != BADADDR )
	{
		dwAddress = RnextB ( dwRegisterFunction, dwAddress );  
		nameptr = GetNamesPtrFromAdr( dwAddress );
		maxentries = Dword( dwAddress + 0xD );
		for (i=0;i<maxentries/8;i++)
		{
			name = GetString( Dword(nameptr), -1, ASCSTR_C );
		
			if(strlen(name) < 4)
				break;
			fname = "Unknown::LUA::" + name;
						
			if ( RenameFunc( Dword(nameptr+4), fname ) == 0 )
				break;
			nameptr = nameptr + 8;
		}
	}
	Message( "Done." );
}

static GetNamesPtrFromAdr( adr )
{
	auto dwRet;
	dwRet = adr - 0x10 + 0x4;
	return ( Dword( dwRet ) - 4 );
}

// 1 = Success, 0 = Failure
static RenameFunc( dwAddress, sFunction )
{
	auto dwRet;

	dwRet = MakeNameEx( dwAddress, sFunction, SN_NOCHECK );

	if( dwRet == 0 )
	{
		auto sTemp, i;
		for( i = 0; i < 32; i++ )
		{
			sTemp = form( "%s_%i", sFunction, i );

			if( ( dwRet = MakeNameEx( dwAddress, sTemp, SN_NOCHECK ) ) != 0 )
			{
				Message( "Info: Renamed to %s instead of %s\n", sTemp, sFunction );
				break;
			}
		}
	}
	return dwRet;	
}

Feel free to use it. ; D