Skip to content

Instantly share code, notes, and snippets.

@assarbad
Last active June 22, 2023 22:06
Show Gist options
  • Save assarbad/ad24f92616418bc04239faa880005895 to your computer and use it in GitHub Desktop.
Save assarbad/ad24f92616418bc04239faa880005895 to your computer and use it in GitHub Desktop.
PCRE for old IDAPython function names
\W(AF2_(?:ANORET|CHKUNI|DATOFF|DOCODE|DODATA|FTAIL|HFLIRT|JUMPTBL|PURDAT|REGARG|SIGCMT|SIGMLT|STKARG|TRFUNC|VERSP)|AF_ASCII|ASCF_(?:AUTO|COMMENT|GEN|SAVECASE|SERIAL)|ASCSTR_(?:C|LEN2|LEN4|PASCAL|TERMCHR|ULEN2|ULEN4|UNICODE)|AddStrucMember|BeginEA|DOUNK_(?:DELNAMES|EXPAND|SIMPLE)|FF_(?:ASCI|DWRD|OWRD|QWRD|STRU|TBYT|VAR)|FIXUP_(?:BYTE|CREATED|EXTDEF|REL|SELFREL|UNUSED)|Fatal|GetFlags|HideArea|INF_(?:BINPREF|BORDER|CHANGE_COUNTER|CMTFLAG|COMPILER|END_PRIVRANGE|HIGH_OFF|LONG_DN|LOW_OFF|MODEL|NAMELEN|REFCMTS|SHORT_DN|SIZEOF_ALGN|SIZEOF_BOOL|SIZEOF_ENUM|SIZEOF_INT|SIZEOF_LDBL|SIZEOF_LLONG|SIZEOF_LONG|SIZEOF_SHORT|START_PRIVRANGE|TYPE_XREFS|XREFS)|Message|REF_VHIGH|REF_VLOW|ResumeProcess|SEGDEL_(?:KEEP|SEGDEL_PERM|SEGDEL_SILENT|ALL|COMPAT|FATAL)|UMessage|Warning|Add(?:UserStkPnt|Union|StrucEx|Struc|SourceFile|SegEx|Hotkey|Enum|EntryPoint|ConstEx|Const|CodeXref|BptEx|Bpt|AutoStkPnt2)|AltOp|Analy[sz]e(?:Area|Range)|Analysis|AppendFchunk|ApplySig|ArmForceBL(?:Call|Jump)|(?:Addr|File|Ident|Long|Seg|Selector|Str|YN)|AttachProcess|Auto(?:Mark2|Show|Unmark)|Batch|BeginTypeUpdating|BochsCommand|Byte|CanExceptionContinue|ChangeConfig|Check(?:Bpt|TraceFile|point)|ChooseFunction|CmtIndent|Comment(?:Ex|s)?|Compile|CreateArray|Dbg(?:Byte|[DQ]word|Read|Word|Write)|DecodeInstruction|DefineException|Del(?:ArrayElement|Bpt|CodeXref|Const(?:Ex)?|Enum|ExtLn[AB]|Fixup|Function|HashElement|Hidden(?:Area|Range)|Hotkey|LineNumber|Seg|Selector|SourceFile|StkPnt|Struc(?:Member)?|DeleteA(?:ll|rray))|Demangle|DetachProcess|DfirstB?|DiffTraceFile|DnextB?|Dword|Enable(?:Bpt|Tracing)|EndTypeUpdating|Eval|Exec(?:IDC)?|Exit|ExpandStruc|ExtLin[AB]|Find(?:Code|Data|Explored|FuncEnd|Immediate|Selector|Unexplored|Void)|First(?:FuncFchunk|Seg)|ForgetException|FormatCData|Gen(?:CallGdl|FuncGdl)|GenerateFile|Get(?:AppcallOptions|ArrayElement|ArrayId|Bmask(?:Cmt|Name)|Bpt(?:Attr|EA|Qty|TevEa)|CharPrm|Color|Const(?:Bmask|ByName|Cmt|Enum|Ex|Name|Value)?|Current(?:Line|Tev|ThreadId)|CustomData(?:Format|Type)|DebuggerEvent(?:Condition)?|DisasmEx|Entry(?:Name|Ordinal|Point(?:Qty)?)|Enum(?:Cmt|Flag|Idx|Name|Qty|Size|Width)?|Event(?:BptHardwareEa|Ea|Exception(?:Code|Ea|Info)|ExitCode|Id|Info|Module(?:Base|Name|Size)|[PT]id)|Exception(?:Code|Flags|Name|Qty)|Fchunk(?:Attr|Referer)|First(?:Bmask|Const|HashKey|Index|Member|Module|StrucIdx)|FixupTgt(?:Displ|Flags|Off|Sel|Type)|FpNum|Frame(?:ArgsSize|LvarSize|RegsSize|Size)?|FuncOffset|Function(?:Attr|Cmt|Flags|Name)|Hash(?:Long|String)|IdaDirectory|IdbPath|Input(?:File(?:Path|Size)?|MD5|SHA256)|Last(?:Bmask|Const|HashKey|Index|Member|StrucIdx)|LineNumber|Local(?:Tinfo|TypeName)|LongPrm|ManualInsn|MarkComment|MarkedPos|Max(?:LocalType|Tev)|Member(?:Comment|Flag|Id|Name|Offset|Qty|Size|StrId)|MinSpd|Mnem|Module(?:Name|Size)|Next(?:Bmask|Const|FixupEA|HashKey|Index|Module|StrucIdx)|NsecStamp|OpType|OperandValue|Opnd|OriginalByte|Prev(?:Bmask|Const|FixupEA|HashKey|Index|StrucIdx)|Process(?:Name|Pid|Qty|State)|Reg(?:Value)?|SegmentAttr|ShortPrm|SourceFile|SpDiff|Spd|StepTraceOptions|StringType|Struc(?:Comment|Id(?:ByName|x)?|Name|NextOff|PrevOff|Qty|Size)|TestId|Tev(?:Callee|Ea|RegMem(?:Ea|Qty)?|RegVal|Return|Tid|Type)|Thread(?:Id|Qty)|Tinfo|TraceDesc|TrueName(?:Ex)?|Type|VxdFuncName|nEnum)|GuessType|Hide(?:Range|Voids)|IdbByte|Indent|Is(?:Bitfield|EventHandled|Float|Func|Int64|Long|Object|Pvoid|String|Union)|Item(?:End|Head|Size)|Jump|Line[AB]|Load(?:Debugger|Til|TraceFile)|LocByName(?:Ex)?|LowVoids|MK_FP|Make(?:Align|Array|Byte|Code|Comm|CustomData|Data|Double|[DOQY]word|Float|Frame|Function|Local|Name(?:Ex)?|PackReal|RptCmt|Struct(?:Ex)?|Tbyte|Unkn(?:own)?|Word)|MarkPosition|(?:Max|Min)EA|MoveSegm|Name(?:Ex)?|Next(?:Addr|Fchunk|FuncFchunk|Function|NotTail|Seg)|OpAlt[12]?|Binary|Cha?r|Dec(?:imal)?|Enum(?:Ex)?|Float|Hex|High|Not|Num(?:ber)?|Octal|Off(?:Ex|set)?|Seg(?:ment)?|Sign|Stkvar|Stroff(?:Ex)?|ParseType|Patch(?:Byte|DbgByte|[DQ]word|Word)|PauseProcess|Prev(?:Addr|Fchunk|Function|NotTail)|PrintLocalTypes|Qword|RebaseProgram|RecalcSpd|Refresh(?:DebuggerMemory|Lists)?|RemoveFchunk|Rename(?:Array|EntryPoint|Seg)|ResumeThread|RfirstB?0?|RnextB?0?|RptCmt|Run(?:Plugin|PythonStatement|To)|SaveTraceFile|ScreenEA|Seg(?:Addrng|Align|Bounds|ByBase|ByName|Class|Comb|Create|DefReg|Delete|Name|Rename)|Sel(?:End|Start)|SelectThread|SendGDBMonitor|Set(?:AppcallOptions|Array(?:Format|Long|String)|Bmask(?:Cmt|Name)|Bpt(?:Attr|CndEx|Cnd)|CharPrm|Color|Const(?:Cmt|Name)|CurrentTev|Debugger(?:EventCondition|Options)|Enum(?:Bf|Cmt|Flag|Idx|Name|Width)|ExceptionFlags|Fchunk(?:Attr|Owner)|Fixup|Function(?:Attr|Cmt|End|Flags)|Hash(?:Long|String)|HiddenRange|InputFilePath|LineNumber|LocalType|LongPrm|ManualInsn|Member(?:Comment|Name|Type)|ProcessorType|Reg(?:Ex|Value)?|RemoteDebugger|Seg(?:Addressing|Bounds|Class|DefReg|Attr)|Selector|ShortPrm|SpDiff|Status|StepTraceOptions|StorageType|Struc(?:Align|Comment|Idx|Name)|TargetAssembler|TraceDesc)|Sleep|Start(?:Debugger|EA)|Step(?:Back|Into|Over|UntilRet)|StopDebugger|StringStp|SuspendThread|TailDepth|TakeMemorySnapshot|Til2Idb|ValidateNames|Voids|Wait|WinDbgCommand|Word|XrefShow|XrefType|ask_selector|auto_make_code|hasValue|is(?:ASCII|Align|Byte|Char0|Char1|Code|Data|DefArg0|DefArg1|Double|Dwrd|Enabled|Enum0|Enum1|Float|Flow|Head|Loaded|Off[01]|Owrd|PackReal|Qwrd|Seg[01]|Stkvar[01]|Stroff[01]|Struct|Tail|Tbyt|Unknown|Word)|patch_long|python_on|set_start_(?:cs|ip)|toEA)\W
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment