XOR EAX __SECURITY_COOKIE

[Former user]

reiat.py will not rename the DWORD if the following code is encountered.

.text:0040ECAD                 mov     edi, eax
.text:0040ECAF                 push    offset aFlsalloc ; "FlsAlloc"
.text:0040ECB4                 push    edi             ; hModule
.text:0040ECB5                 call    esi ; GetProcAddress
.text:0040ECB7                 xor     eax, ___security_cookie
.text:0040ECBD                 push    offset aFlsfree ; "FlsFree"
.text:0040ECC2                 push    edi             ; hModule
.text:0040ECC3                 mov     dword_4242E0, eax
.text:0040ECC8                 call    esi ; GetProcAddress
.text:0040ECCA                 xor     eax, ___security_cookie
.text:0040ECD0                 push    offset aFlsgetvalue ; "FlsGetValue"
.text:0040ECD5                 push    edi             ; hModule
.text:0040ECD6                 mov     dword_4242E4, eax
.text:0040ECDB                 call    esi ; GetProcAddress
.text:0040ECDD                 xor     eax, ___security_cookie
.text:0040ECE3                 push    offset aFlssetvalue ; "FlsSetValue"
.text:0040ECE8                 push    edi             ; hModule

[Alexander Hanel]

This is a bug in my logic assuming a function end follows the code.

Python>hex(here())
0x40ecdb
Python>curFunc = idaapi.get_func(here())
Python>hex(curFunc.endEA)
0x40d7ae

I will need to figure out a better way to test boundaries.

[Alexander Hanel]

  def traceForwardRename(self, address, apiString):
        'address is call GetProcAddress, apiString is the API name'
        currentAddress = NextHead(address)
        funcAddress = list(FuncItems(address))
        var = 'eax'
        lastref = ''
        lastrefAddress = None
        while currentAddress in funcAddress:
            dism = GetDisasm(currentAddress)

The above code solves the issue. Relying on the end address to be higher than the current address is flawed because the code can jump any where.