3

I need to rename some memory address "names" in IDAPython. I'm talking about the dword_805672 formatted ones. Please see the screenshot below:

enter image description here

I've placed red boxes around the names which I would like to rename with IDAPython. I've searched the API docs and I came up with: idc.MakeName(ea,name) however, as you can see, this only placed a name in the spots labeled dynamic_1, dynamic_2 and so on. I want to rename the actual operand.

the_endian
  • 1,860
  • 17
  • 39

1 Answers1

4

idc.MakeName should be the correct api command. I'm assuming that you did something like idc.MakeName(0x123772cd, 'dynamic_3') instead of doing the make name on the actual dword in the instruction.

Something like this should be done instead:

idc.MakeName(idc.GetOperandValue(0x123772cd, 0), 'dynamic_3')

In this case idc.GetOperandValue will return the value of the zeroth operand (ie. 0x123ef5e0). That address will then be labeled 'dynamic_3' and IDA should update the UI to show the change.

Bambu
  • 556
  • 2
  • 8
  • Yup. That was it, thanks. I hadn't realized that the operand itself has its own address like that in terms of solving this problem. Do you have any tips on how to learn the little fine ins and outs of the API like this? This is the kinda stuff that's not really in the docs :( – the_endian Nov 27 '17 at 05:16
  • I usually default to looking at the idc/idaapy/idautil python files when trying to figure out how something is done. Besides that, the resources on https://reverseengineering.stackexchange.com/questions/11391/good-training-for-idapython are pretty good. – Bambu Nov 28 '17 at 03:33