Binary Ninja snippets

log_func_rename.py

#Extract function name from log calls
#
logger = "LogFuncRename"

def log_func_rename(log_function, name_index):
    func_votes = defaultdict(lambda: defaultdict(lambda: 0))
    for call_site in log_function.caller_sites:
        if not isinstance(call_site.hlil.operands[0], HighLevelILConstPtr):
            continue
        if call_site.hlil.operands[0].constant != log_function.start:
            continue
        if name_index >= len(call_site.hlil.instruction_operands):
            log_warn(f"Call site {call_site.address:#x}: Too few operands", logger)
            continue
        name_param = call_site.hlil.instruction_operands[name_index]
        if isinstance(name_param, HighLevelILConstPtr):
            name, _ = name_param.string
            func_votes[call_site.function][name] += 1
        else:
            log_warn(f"Call site {call_site.address:#x}: Non-constant name argument", logger)
    for caller, votes in func_votes.items():
        if len(votes) == 1:
            func_name = next(iter(votes.keys()))
            log_info(f"Function {caller.start:#x}: Unanimously renaming to {func_name}", logger)
        elif len(votes) > 1:
            func_name, _ = max(votes.items(), key=lambda x: x[1])
            other_func_names = set(votes.keys()) - {func_name}
            log_info(f"Function {caller.start:#x}: Renaming by majority to {func_name} "
                f"(potentially inlined: {', '.join(other_func_names)})", logger)
        caller.name = func_name

log_func_f = AddressField("Name or address of logging function", current_view)
name_index_f = IntegerField("Zero-based index of caller name parameter")
if get_form_input([log_func_f, name_index_f], "Logging function parameters"):
    log_func = current_view.get_function_at(log_func_f.result)
    if log_func is None:
        log_error(f"No function at address {log_func_f.result:#x}", logger)
    else:
        log_func_rename(log_func, name_index_f.result)