行业解决方案查看所有行业解决方案
IDA 用于解决软件行业的关键问题。
发布时间:2022-10-15 11: 27: 57
Action name: OpenFunctions
A list of all functions in the program is displayed. You can add, delete, modify functions using list viewer commands.
Listed for each function are:
- function name
- segment that contains the function
- offset of the function within the segment
- function length in bytes
- size (in bytes) of local variables + saved registers
- size (in bytes) of arguments passed to the function
The last column of this window has the following format:
R - function returns to the caller
F - far function
L - library function
S - static function
B - BP based frame. IDA will automatically convert
all frame pointer [BP+xxx] operands to stack
variables.
T - function has type information
= - Frame pointer is equal to the initial stack pointer
In this case the frame pointer points to the bottom of the frame
M - reserved
S - reserved
I - reserved
C - reserved
D - reserved
V - reserved
If a function has its color set, its line is colored using the specified color. Otherwise library and lumina functions are colored with the corresponding color. Otherwise the line is not colored.
A bold font is used for functions that have definite (user-specified) prototype. Also some plugins too may set this flag. Such prototypes are taken as is by the decompiler, while other prototypes are considered only as a starting point during decompilation.
It is possible to automatically synchronize the function list with the active disassembler, pseudocode, or hex view. For that right click on the function list and select "Turn on synchronization".
中文翻译如下:
操作名称:OpenFunctions
显示程序中所有函数的列表。您可以使用列表查看器命令添加、删除、修改函数。
列出了每个函数:
● 函数名称
● 包含函数的段
● 函数在段内的偏移量
● 函数长度(以字节为单位)
● 局部变量和保存寄存器的大小(以字节为单位)
● 传递给函数的参数的大小(以字节为单位) 此窗口的最后一列具有以下格式: R-函数返回给调用者 F-远程函数 L-库函数 S-静态函数 B-BP 基础框架。IDA 将自动将所有帧指针 [BP+xxx] 操作数转换为堆栈变量。 T-函数具有类型信息 = - 帧指针等于初始堆栈指针,在这种情况下,帧指针指向帧底部 M-保留 S-保留 I-保留 C-保留 D-保留 V-保留 如果函数已设置其颜色,则使用指定的颜色着色它的行。否则,库和 Lumina 函数会以相应的颜色进行着色。否则,该行不会被着色。 加粗字体用于拥有确定(用户指定)原型的函数。某些插件也可以设置此标志。反编译器将直接使用这些原型,而其他原型仅在反汇编期间被视为起点。 可以自动将函数列表与活动的反汇编器、伪代码或十六进制视图同步。因此,请右键单击函数列表并选择“打开同步”。
展开阅读全文
︾