This page presents IDA macros I’ve written.

Load PE/COFF symbols

Introduction

It appears that when IDA parses symbols of Windows applications compiled with gcc (cygwin), it does not load symbol names properly. I.e. instead of real function names, you see things like sub_401064.

The problem is that gcc uses stores symbol information in slightly different manner, which IDA does not understand. The macro below fixes this.

Download

Grab it here.

Installation and use

To install it, do the following:

1. Close all instances of IDA.
2. Put it in idc directory, in IDA’s installation directory.
3. Start IDA

After installing the script, the script will automatically process every binary file you open and fix the symbols if it sees gcc’s symbol table format.

You can see it works if you see following line in the log window.

-------- PE/COFF Symbol Name Parser ------------------

Same script but in a standalone version

This is a standalone version of the same script. Grab it here. To run it, save it somewhere on your computer and run it via File->IDC File menu.