[Scag]

I think I've gotten the hang of writing IDA scripts recently so I thought I'd share them with you all.

I've got a couple of scripts in this repo. You should check them out, they're pretty awesome. The awesomer ones I'll explain here.

Netprop Importer

Spoiler

It parses a netprop dump (given by sm_dump_netprops_xml) and is able to build IDA structs and insert members at the provided offsets. It kinda shits the bed when it comes to datatables but it's very very useful regardless. You should also, obviously, dump and import the proper dump for your OS.

The importer also provides virtual table importing as well. This does what you think it does, imports the vtables of the provided classes from the same dump and adds its type to the struct at offset 0.

It should be noted that the vtable part of the importer only works in Linux, Windows would not be fun to try and do. Also, it kinda makes IDA flip its shit when it comes to globals; e.g. engine thinks its a CBaseEntity occasionally. But other than that, it really cleans up those ugly dereferences. Another caveat is that member offsets, when viewing through pseudocode, show up as gap and then a trailing number. It should be straightforward in telling that the trailing number is the raw offset.

Spoiler

Gamedata Checker

Spoiler

It's fairly straightforward, it parses a gamedata file and tells you if your signatures and offsets are correct.

This requires Valve's VDF library. Install it with pip install vdf.

It has a few quirks with it at the moment:

• It does not support multi-line comments within gamedata files nor will it support multiple instances of #default keys. Parsing core SourceMod gamedata files is all but verboten.
• VTable functions that are stripped cannot be verified, obviously.
• Function overloads tends to mess up VTable offset checking; e.g. CBasePlayer::GiveNamedItem vs CTFPlayer::GiveNamedItem.
• Offset checking is variably difficult depending on naming conventions. If the gamedata key name is not named exactly the same as the function name, it will not be found; e.g. OnTakeDamage -> CBaseEntity::OnTakeDamage and CTFPlayer::OnTakeDamage -> CBaseEntity::OnTakeDamage but TakeDamage != CBaseEntity::OnTakeDamage.

Symbol Smasher.

Spoiler

An IDA script that compares Linux (symboled) and Windows binaries and attempts to interpret the stripped functions on the Windows side.

To be specific, it runs through Linux's strings and stores all of their xref data to a YAML file. Then it runs through Windows' strings and compares the 2 sets.

One of the comparison methods is unique string xref sequences. In the script this is called "Simple Comparisons". If a symboled Foo::Bar() references "FizzBuzz" twice and "Foo_Foo" once and is the only function to have those exact references, then a function on Windows with that exact behavior can be typed. "FizzBuzz" and "Foo_Foo" can be used elsewhere, but only Foo::Bar() has that kind of sequence.

Secondly, it also compares subset xrefs. If Foo::Bar on Linux references "Foo_Foo" twice, and a stripped function on Windows references "Foo_Foo" twice and "FizzBuzz" once, and Foo::Bar is the only function that has a subset of these xrefs, then the Windows function must be Foo::Bar. It also goes both ways, looking at stripped Windows functions in the same way.

Once the script figures out what a sub_ function is, it renames it to the mangled, Linux name. IDA then unmangles it for you so you can search it in your Functions window. Now you have a nice handful of symbols on your Windows binary.

It should be noted that not all found functions are guaranteed to be correct. It is unpredictable how Linux functionality (mainly inlining) translates to Windows. If all else fails you can simply rename functions yourself.

You can even use the symbol smasher alongside the netprop importer to really, really clean up your Windows pseudocode.

For non-pro users
Fret not! I publicly host signature dumps from the Symbol Smasher for most Source games.

You'll find dumps here and I'll try to keep them reasonably updated.

VTable Importer

Spoiler

Imports virtual tables from Linux to Windows. Run it through a Linux binary to export to a file, then run it through a Windows binary to import those VTables into the database. The import process will rename the sub_ functions to their proper, mangled name.

This is similar to Asherkin's VTable Dumper but doesn't suffer from the pitfalls of multiple inheritance. Since it doesn't have those liabilities, it's function typing will almost always be perfect. 32-bit only for now.

Larger download button

The Symbol Smasher has its own repo

Free gamedata pwease