/IDAStringXref

Find more string xrefs and use them to create function maps between different binary versions

Primary LanguagePython

IDA string xref and binary migration scripts

NOTE: This repo is in a very early stage. The code is not usable without a decent amount of fiddling, so use with care.

The purpose of this repo is two-fold:

  • Provide a script which helps to find and add more string xrefs which IDA doesn't seem to find well (may only really work on the windows build of NMS.)
  • Provide a way to migrate names from one binary version to another by comparing string xrefs between the two versions (as well as other methods in the future hopefully!)

Usage

In the following we define source as the original binary (ie. the one with all/most functions named), and target as the binary which you wish to map the names to.

  1. Run more_string_xrefs.py on both source and target exe's in IDA.
  2. Ensure that save_string_xrefs.py has named = True (line 25) and run this script on the source exe.
  3. Modify that same file and have named = False, and run the script on the target exe.
  4. Run load_string_refs.py in either exe.
  5. Once that has completed, run rename_funcs.py in the target exe.