Mapimp 0.4
This is an open source OllyDbg plugin which will help you to importmap files exported by IDA or Dede.
There are many plugins using which you can perform similar
actions, but mapimp:
- Recognizes debugged file segments and applies names correctly
- Has an option to overwrite or skip names that intersect already defined
- Has a filter option which gives you great name demangling potential
• Filter
The main idea is to apply series of masks to every single name loaded. Mask syntax goes
as follows:
/key[/]regex
Key "c" cuts the matched substring selected by regular expression
name: System::__linkproc__ GetMem(int)
mask: /c__linkproc__
applied: System::GetMem(int)
Key "s" skips the name if regular expression succeeds. It may be useful if you
want to skip some dummy or incorrect names
name: unknown_libname_2519
mask: /sunknown_libname_
applied:
Key "r" replaces the substring selected by regular expression with your own
/rsubstring/regex
As you can see slash character delims your substring from the regular expression.
Use double slash to define slash as a character of your substring
name: System@Function(System@AnsiString;System@AnsiString)
mask: /rsys::/System@
applied: sys::Function(sys::AnsiString;sys::AnsiString)
name: System@Function(System@AnsiString;System@AnsiString)
mask: /r//_/@
applied: System/_Function(System/_AnsiString;System/_AnsiString)
Remember that if the name met the mask condition it will be changed, then the
second mask is applied to the changed name and so on. The order of mask applying
is undefined so be careful, because some masks may intersect
As about regular expressions, the plugin uses pcre library which syntax is
compatible with perl regular expressions. Check www.pcre.org for docs and
sources
Updated.
- fixed map file parsing routine. Now you can load map files exported by Interactive Delphi Reconstructor or similar
- fixed a bug with global shortcuts. The god damn ODBG_Pluginshortcut callback is called even when you try to find something in the names window. Weird fact, really. Now press Ctrl + Shift + I to import and Ctrl + Shift + M to open options window
页:
[1]