There is not sark api for SetType / ApplyType

[yoava333]

if I want to write a script that applies a function prototype I cannot do this from sark and have to to fall back to IDAPython with SetType / ApplyType.

[tmr232]

Do you have a usage example?
I'd be happy to add this to Sark.

[yoava333]

In linux binaries compiled with -fPIE (here) IDA is is not able to get the function signatures to propagate to the .plt.got functions. here's a script that fixes that problem and sets the right prototypes.

import sark

def get_seg_by_name(name):
	for seg in sark.segments():
		if seg.name == name:
			return seg
	return None


def fix_pie_func(addr=None, reg='ebx'):
	if not addr:
		addr = sark.Line()
	
	# get got
	got = get_seg_by_name('.got')

	insn = addr.insn
	if insn.mnem != 'jmp' or len(insn.operands) != 1:
		return

	opnd = insn.operands[0]
	if opnd.reg != reg:
		return

	offset = opnd.offset

	name = None
	proto = None
	got_line = list(got.lines)[offset / sark.get_native_size()]
	for dref in got_line.drefs_from:
		dref_addr = sark.Line(dref)
		name = dref_addr.name
		proto = GetType(dref_addr.ea)
		if name:
			break
	else:
		print "couldn't find name for {}".format(got_line.name)
		return

	sark.Function(addr).name = '{}_0'.format(name)
	if proto:
		SetType(addr.ea, proto)


def fix_pie(reg='ebx'):
	for func in get_seg_by_name('.plt.got').functions:
		fix_pie_func(next(func.lines), reg)

[tmr232]

Any preferences as to the API style? f.set_type(...) vs f.type = .... vs something else?

[yoava333]

I like f.type = better
Thanks!

[tmr232]

Care to take a look at the PR?

I am still conflicted regarding a solution for ApplyType, as I want to be able to retrieve the type object as well. So it can't be the same property. Unless...

I can allow assigning both strings and type objects, that's easy.
As for the return type, I can return a wrapper around the type info, which readily converts to string. I'm not if that's a good course, though. Any opinions?

[yoava333]

LGTM :-)