Propagate arguments of the caller to the callee downwards

[ricnar456]

I reversed and got this call with the names and types of each argument.

But within the call itself, I have nothing; to propagate the type and name of each argument, I have to do it manually, one by one. Couldn't there be an option to propagate all argument names and types from the caller to the callee with a single click?

[ricnar456]

I consulted with IDA support and they told me that this is not supported and will not be supported, that the auto rename option of the HRT plugin does it, but it doesn't. Maybe could be a good idea try to add it.

[srgblv]

Such a propagation should work automatically with hrtng. But there is limitation described in doc

Additionally AutoRenamer does name and type info propagation across call graph:
...
If call's argument has name and the called function has not: type and name of argument will be propagated into called function type (only if count of x-refs to such func is not greater five to avoid renaming args in popular funcs like memcpy, alloc, etc).

So, it doesn't work if AutoRenamer is disabled in the plugin's config. Or callee (NtfsCallStorageDriver) has more then 5 callers.
You may easyly change number 5 here in the source code to bigger number or change it to zero to turn off references counting and recompile the plugin.

[ricnar456]

That's right, this function has 10 references, so it can't be automatically renamed.

Could you add the option to change this value without recompiling in future versions of the plugin? Perhaps in a configuration file or a menu to easily adjust this number? And what if it were possible to bypass the limit only for the current function to prevent malfunctioning?

[ricnar456]

in this case it does not work

the function only have two references the name is _VCB as the type.

the callee has one only argument and is not named VCB and its type it's not VCB .

but the plugin renames other variables outside the call, i think renaming is enabled

[ricnar456]

the renaming of the argument of the calle works if in the caller I right click and choose [hrt] RENAME func, choose the same name or other and when accept the callee argument is renamed to _VCB and the type is changed.

[ricnar456]

There are functions with fewer than 5 references where it works and others where it doesn't. I think there should be an option in the context menu (right-click) to attempt renaming and setting the types on the callee, and that this should be done independently of the references and not propagate to other child functions, resolving it only in that call.

[srgblv]

Things a bit complicated. To decrease number of false renaming/recasting callee arguments here are few more additional checks:

• callee must not be marked as Library function
• the func prototype should not be marked as Library
• call args should be good named, callee parameters - bad named
• checks on each argument for what side has weak or strong type

I think there should be an option in the context menu (right-click) to attempt renaming and setting the types on the callee, and that this should be done independently of the references and not propagate to other child functions, resolving it only in that call.

Not sure about the new context menu item. Anyway changing prototype will affects references, propagate up and down and require manual intervention. All the talk here how to reduce manual work. Lets begin from configurable references count.

[ricnar456]

I don't understand why, if I arrive at a call by reversing the arguments and types, and I have to copy them one by one manually into the call, there can't be an option that copies them and changes the types within the call so I don't have to do it manually. Then, if I see something doesn't match, I'll fix it, but I don't see the problem with automating what you have to do manually.

[ricnar456]

Look at the first two images: the arguments and types are reversed, and when I need to continue reversing inside the call, I have to manually copy them one by one and set the types one by one. If there's an option in the context menu to copy them and set the types, it will only do so if I deem it necessary. (not automatically)

[srgblv]

Propagation names and types pulled up from callee is right - directed from general to specific. We always trust it.
Opposite direction from caller to callee, from specific to general is very thin ice. It is too easy to make an incorrect assumption that will affect all further work.

After years of reversing and discussions with many of colleagues, this is the first time I have encountered the problem you raised. Here already seven lines of context menu are added by hrtng on a call statement. Full context menu is not always fit into laptop screen. Should I add one more line for a such rare case? Not sure. Configurable number of "too popular func" xrefs will be submitted soon.

[ricnar456]

Doing it manually is the same. If something goes wrong, the callee will have an incorrect argument, but 15 minutes later. If the arguments are correct and copied manually, all the arguments in the callee will be correct, but 15 minutes later, i have to continue and repair if necessary automatically or manually, copying automatically will be quickly in both cases.

[srgblv]

By the way, it is not necessary to copy the arguments one by one, you can copy them all at once by pasting the copied into the function prototype.

[ricnar456]

It is not possible, you cannot copy the names and types reversed in the calling function, if you press Y , the prototype appears in the calling function without the arguments and with the types reversed, the callee names and types appear.

[ricnar456]

the Y option gets the arguments of the callee.

[ricnar456]

set call type gets the arguments from the calee too

[ricnar456]

If you could copy the function prototype with its reversed names and types in the caller, and then enter the callee, press Y and paste it all, that would be great, but it's not possible because there's no way to copy the function with the reversed names and types in the caller.

[ricnar456]

"After years of reversing and discussions with many of colleagues, this is the first time I have encountered the problem you raised. Here already seven lines of context menu are added by hrtng on a call statement. Full context menu is not always fit into laptop screen. Should I add one more line for a such rare case? Not sure. Configurable number of "too popular func" xrefs will be submitted soon."

I started reversing in 1995 and i have 20 years writing exploits professionally for Core Impact, i think my opinion is important too. (put the option in another menue like add dummy struct, not in the rigth click context menu)

[srgblv]

I respect someone's opinion, no matter how many years you've been in the industry. But please respect my time too, and don't insist that I do something that is redundant or untimely now from my point of view. Maybe the polling will find the truth. Or. It's open source, please make a fork and hack the code as you wish

[ricnar456]

That's a shame, your plugin is excellent, I use it a lot and it's great for speeding up reversing. It's a pity it's missing something so basic. Don't worry, it was just an idea to add a feature that I think is missing in IDA.

[ricnar456]

Thank you for adding a settings option.