IDA Script, get function that has random characters in its name

Question

I was trying to figure out if there is a way I can get the address for a function name that has random characters in it. For example the function name is "Player_GetStats_m29275" here the "m292755" is random characters. So I want to search the name of the function by just "Player_GetStats" so it gives me the address of the function.

get_name_ea is not good for doing this. I can search the function with find_text but it's too slow and takes a lot of time even if I mention the segment.

Answer 1

As far as I know, IDA doesn't have a function_name_to_address() that gets a pattern and returns an address. You can iterate over all the functions and check if their name matches the one you want. It should not take too long.

from idautils import *
from idaapi import *
from idc import *

ea = BeginEA()
for funcAddr in Functions(SegStart(ea), SegEnd(ea)):
    funcName = GetFunctionName(funcAddr)
    # Check if the function name starts with "Player_GetStats"
    if funcName.startswith("Player_GetStats"):
        print "Function %s is at 0x%x" % (funcName, funcAddr)

Alternatively you can use regular expression to match the name you want:

import re

funcName = "Player_GetStats_m29275"
re.compile("^Player_GetStats_\w\d{5}$")
if pattern.match(funcName):
   "%s match the pattern" % funcName

Explanation:

• ^ is for "begins with"
• \w matches one word character ("m" in this case)
• \d matches a digit
• {5} checks that the previous expression (\d) is repeating 5 times
• $ is for "end of line"