Command to forward type propagate into called functions

[plafosse]

Forward type propagation into called functions is very tricky to do correctly. This is something we haven't yet attempted. However it's frequent that when reverse engineering we do this manually. We should simplify this process by providing a Command which will do this. Something like "Infer function prototype"

[xusheng6]

Related to #772 and #3270

[xusheng6]

A related workflow is to select a variable or a type, and do froward propagation at all function calls where this type is seen. Might need to repeat the process until no new one is seen.

[robert-yates]

this is indeed a painful repetitive task, i want to create a simple script where i can click a variable and make it set the name and type in the prototype of all calls where its used in the function, and eventually recursively

it doesn't seem so straight forward, does anyone have an implementation suggestion?

my use case and idea is as follows:

1. manually identified a structure on the stack and created its type.
2. in HLIL find all calls
3. check if call uses this variable
4. set a name and type

i choose HLIL because calls can take direct pointer types of the structure and it
removes the need to find all assignments in MLIL that create an additional pointer type.

however how to find all calls in HLIL to get their parameters?
it seems to me i have to parse each instructions AST as calls can be deep inside an expression and requires knowledge of every single instruction to parse in order just to find the calls.

is there an easier way? i suspect there is :)

[xusheng6]

Note this is the opposite direction of #773

[xusheng6]

I think we should not only propagate the type, we should probably also propagate the parameter name. Not sure if we want it to be optional, though

[xusheng6]

I have add this in dev 4.2.6142. You can select either a function call, or a variable, and press "Q" on it:

1. If you select a function call, it will calculate the type of the arguments at the callsite, and set the type of the callee's parameter accordingly.
2. If you select a variable, it will propagate its type to all functions that has it as an argument

In both case, if the variables have a non-default name, the name of the parameter will be set