wpeace-hch / sysnr-funcfinder

A plugin for IDA that renames functions by system call numbers.

WPeace-HcH 👋

• 🌱 I’m a threat intelligence analyst in China.
• 🔭 Focus on BOTNET and APT.
• 📫 How to contact me: [email protected]

Popular repositories

sysnr-funcfinder's Issues

2.1 版本分析mips错误

SysNR-FuncFinder v2.1 start running...
_WPe_mmap
_WPe_clone
Traceback (most recent call last):
  File "C:/Users/IDA/Desktop/IDA_Pro_7.7/plugins/SysNR-FuncFinder.py", line 142, in activate
    self.plugin.patcher()
  File "C:/Users/IDA/Desktop/IDA_Pro_7.7/plugins/SysNR-FuncFinder.py", line 60, in patcher
    LinuxFuncFinder_Mips32.main()
  File "C:\Users\IDA\Desktop\IDA_Pro_7.7\plugins\LffPlugDir_WPeace\LinuxFuncFinder_Mips32.py", line 577, in main
    ReName_DirectCall()
  File "C:\Users\IDA\Desktop\IDA_Pro_7.7\plugins\LffPlugDir_WPeace\LinuxFuncFinder_Mips32.py", line 457, in ReName_DirectCall
    callNumber = int(opString, 16)
ValueError: invalid literal for int() with base 16: '40+var_24($sp)'

Got the error of "list index out of range"

Hi, thank u for this plugin, when i tried it, i got an error,
SysNR-FuncFinder v1.5 start running...
LinuxFuncFinder_x64 finished！总共重命名0个函数
Traceback (most recent call last):
File "D:/IDA_Pro_7.7/plugins/SysNR-FuncFinder_WPeace.py", line 138, in activate
self.plugin.patcher()
File "D:/IDA_Pro_7.7/plugins/SysNR-FuncFinder_WPeace.py", line 53, in patcher
LinuxFuncFinder_x64.main()
File "D:\IDA_Pro_7.7\plugins\LffPlugDir_WPeace\LinuxFuncFinder_x64.py", line 396, in main
RenameStartFunc()
File "D:\IDA_Pro_7.7\plugins\LffPlugDir_WPeace\LinuxFuncFinder_x64.py", line 387, in RenameStartFunc
GetMainFunc(func)
File "D:\IDA_Pro_7.7\plugins\LffPlugDir_WPeace\LinuxFuncFinder_x64.py", line 378, in GetMainFunc
mainAddr = int(mainOP.split("sub_")[1], 16)
IndexError: list index out of range

不能正常使用

_启动插件后没有错误但是也没有正常工作，logr如下。
log

SysNR-FuncFinder v2.3 start running...

当前插件仅支持EXEC可执行ELF文件。

报错：
SysNR-FuncFinder v2.2 start running...
当前插件仅支持EXEC可执行ELF文件。

不知道为什么，我手上的ELF文件全都是这样，就算修改后缀名为ELF也不能使用插件
不清楚是BUG还是我的操作问题，因为我看issue里面只有我是这样的

Error：请确认调用规则是否正确

DEMO.zip
1.可否支持一下arm64?
2.我认为此处匹配不严谨op = re.findall('(?<=0x9).*$', op);，建议匹配到SVC后通过IDAAPI遍历汇编上下文处理
3.有部分混淆的so，ida无法识别成函数，使用函数遍历的方式可能会错过某些SVC，希望考虑以下场景。

Error：请确认调用规则是否正确

MIPS 32位系统调用号恢复错误。

syscall 4142 程序恢复为：newselect，实际应该为pipe
参考地址：https://syscalls.w3challs.com/?arch=mips_o32

V2.5_X86_ValueError 奇怪的错误

433:
CallNumber = int(opString, 16)
ValueError: invalid literal for int() with base 16: ' offset sub_8099200'