archive: add 5 repo prompt(s) [skip ci]

archive/a1ext/auto_re.txt

@@ -0,0 +1,957 @@
+Project Path: arc_a1ext_auto_re_rc0lblvb
+
+Source Tree:
+
+```txt
+arc_a1ext_auto_re_rc0lblvb
+├── README.md
+├── auto_re.py
+├── docs
+│   ├── auto_rename_dst.png
+│   ├── auto_rename_src.png
+│   ├── function_rename.png
+│   ├── tags_in_unexplored_code.png
+│   ├── tags_view_0.png
+│   └── tags_view_1.png
+└── ida-plugin.json
+
+```
+
+`README.md`:
+
+```md
+AutoRE
+===
+
+
+Features
+========
+
+## 1. Auto-renaming dummy-named functions, which have one API call or jump to the imported API
+
+### Before
+![auto_rename_src.png](docs/auto_rename_src.png)
+
+### After
+![auto_rename_dst.png](docs/auto_rename_dst.png)
+
+
+## 2. Assigning TAGS to functions accordingly to called API-indicators inside
+
+* Sets tags as repeatable function comments and displays TAG tree in the separate view
+
+
+Some screenshots of TAGS view:
+
+![tags_view_0.png](docs/tags_view_0.png)
+
+![tags_view_1.png](docs/tags_view_1.png)
+
+How TAGs look in unexplored code:
+![tags_in_unexplored_code.png](docs/tags_in_unexplored_code.png)
+
+
+You can easily rename function using its context menu or just pressing `n` hotkey:
+
+![function_rename.png](docs/function_rename.png)
+
+# Installation
+
+Just copy `auto_re.py` to the `IDA\plugins` directory and it will be available through `Edit -> Plugins -> Auto RE` menu
+```
+
+`auto_re.py`:
+
+```py
+# -*- coding: utf-8 -*
+__author__ = 'Trafimchuk Aliaksandr'
+__version__ = '2.2'
+
+from collections import defaultdict
+import idaapi
+from idautils import FuncItems, CodeRefsTo
+from idaapi import o_reg, o_imm, o_far, o_near, o_mem, o_displ
+import os
+import re
+import sys
+import traceback
+
+
+HAS_PYSIDE = idaapi.IDA_SDK_VERSION < 690
+if HAS_PYSIDE:
+    from PySide import QtGui, QtCore
+    from PySide.QtGui import QTreeView, QVBoxLayout, QLineEdit, QMenu, QInputDialog, QAction, QTabWidget
+else:
+    if idaapi.IDA_SDK_VERSION >= 920:
+        from PySide6 import QtGui, QtCore
+        from PySide6.QtGui import QAction
+        from PySide6.QtWidgets import QTreeView, QVBoxLayout, QLineEdit, QMenu, QInputDialog, QTabWidget
+    else:
+        from PyQt5 import QtGui, QtCore
+        from PyQt5.QtWidgets import QTreeView, QVBoxLayout, QLineEdit, QMenu, QInputDialog, QAction, QTabWidget
+
+
+try:
+    # Python 2.
+    xrange
+except NameError:
+    # Python 3.
+    xrange = range
+
+
+# enable to allow PyCharm remote debug
+RDEBUG = False
+# adjust this value to be a full path to a debug egg
+RDEBUG_EGG = r'c:\Program Files\JetBrains\PyCharm 2017.1.4\debug-eggs\pycharm-debug.egg'
+RDEBUG_HOST = 'localhost'
+RDEBUG_PORT = 12321
+
+
+TAGS_IGNORE_LIST = {
+    'OpenProcessToken',
+    'DisconnectNamedPipe'
+}
+
+IGNORE_CALL_LIST = {
+    'RtlNtStatusToDosError',
+    'GetLastError',
+    'SetLastError'
+}
+
+TAGS = {
+    'net': ['WSAStartup', 'socket', 'recv', 'recvfrom', 'send', 'sendto', 'acccept', 'bind', 'listen', 'select',
+            'setsockopt', 'ioctlsocket', 'closesocket', 'WSAAccept', 'WSARecv', 'WSARecvFrom', 'WSASend', 'WSASendTo',
+            'WSASocket', 'WSAConnect', 'ConnectEx', 'TransmitFile', 'HTTPOpenRequest', 'HTTPSendRequest',
+            'URLDownloadToFile', 'InternetCrackUrl', 'InternetOpen', 'InternetOpen', 'InternetConnect',
+            'InternetOpenUrl', 'InternetQueryOption', 'InternetSetOption', 'InternetReadFile', 'InternetWriteFile',
+            'InternetGetConnectedState', 'InternetSetStatusCallback', 'DnsQuery', 'getaddrinfo', 'GetAddrInfo',
+            'GetAdaptersInfo', 'GetAdaptersAddresses', 'HttpQueryInfo', 'ObtainUserAgentString', 'WNetGetProviderName',
+            'GetBestInterfaceEx', 'gethostbyname', 'getsockname', 'connect', 'WinHttpOpen', 'WinHttpSetTimeouts',
+            'WinHttpSendRequest', 'WinHttpConnect', 'WinHttpCrackUrl', 'WinHttpReadData', 'WinHttpOpenRequest',
+            'WinHttpReceiveResponse', 'WinHttpQueryHeaders', 'HttpSendRequestW', 'HttpSendRequestA', 'HttpAddRequestHeadersW', 
+            'HttpAddRequestHeadersA', 'HttpOpenRequestW', 'HttpOpenRequestA', 'NetServerGetInfo', 'NetApiBufferFree', 'NetWkstaGetInfo',
+            'getnameinfo', 'getpeername', 'socketpair'],
+    'spawn': ['CreateProcess', 'ShellExecute', 'ShellExecuteEx', 'system', 'CreateProcessInternal', 'NtCreateProcess',
+              'ZwCreateProcess', 'NtCreateProcessEx', 'ZwCreateProcessEx', 'NtCreateUserProcess', 'ZwCreateUserProcess',
+              'RtlCreateUserProcess', 'NtCreateSection', 'ZwCreateSection', 'NtOpenSection', 'ZwOpenSection',
+              'NtAllocateVirtualMemory', 'ZwAllocateVirtualMemory', 'NtWriteVirtualMemory', 'ZwWriteVirtualMemory',
+              'NtMapViewOfSection', 'ZwMapViewOfSection', 'OpenSCManager', 'CreateService', 'OpenService',
+              'StartService', 'ControlService', 'ShellExecuteExA', 'ShellExecuteExW', 'execve', 'execvp', 'fork', 'popen', 'execl',
+              'posix_spawn'],
+    'inject': ['OpenProcess-disabled', 'ZwOpenProcess', 'NtOpenProcess', 'WriteProcessMemory', 'NtWriteVirtualMemory',
+               'ZwWriteVirtualMemory', 'CreateRemoteThread', 'QueueUserAPC', 'ZwUnmapViewOfSection', 'NtUnmapViewOfSection'],
+    'com': ['CoCreateInstance', 'CoInitializeSecurity', 'CoGetClassObject', 'OleConvertOLESTREAMToIStorage', 'CreateBindCtx', 
+            'CoSetProxyBlanket', 'VariantClear'],
+    'crypto': ['CryptAcquireContext', 'CryptProtectData', 'CryptUnprotectData', 'CryptProtectMemory',
+               'CryptUnprotectMemory', 'CryptDecrypt', 'CryptEncrypt', 'CryptHashData', 'CryptDecodeMessage',
+               'CryptDecryptMessage', 'CryptEncryptMessage', 'CryptHashMessage', 'CryptExportKey', 'CryptGenKey',
+               'CryptCreateHash', 'CryptDecodeObjectEx', 'EncryptMessage', 'DecryptMessage'],
+    'kbd': ['SendInput', 'VkKeyScanA', 'VkKeyScanW'],
+    'file': ['_open64', 'open64', 'open', 'open64', 'fopen', 'fread', 'fclose', 'fwrite', 'flock', 'read', 'write',
+             'fstat', 'lstat', 'stat', 'chmod', 'chown', 'lchown', 'link', 'symlink', 'readdir', 'readdir64', 'sync', 'ftell', 'opendir'],
+    'reg': ['RegOpenKeyExW', 'RegQueryValueExW', 'RegSetValueExW', 'RegCreateKeyExW', 'RegDeleteValueW', 'RegEnumKeyW', 'RegCloseKey', 
+            'RegQueryInfoKeyW', 'RegOpenKeyExA', 'RegQueryValueExA', 'RegSetValueExA', 'RegCreateKeyExA', 'RegDeleteValueA',
+            'RegEnumKeyA',  'RegQueryInfoKeyA'],
+    'dev': ['DeviceIoControl', 'ioctl'],
+    'wow': ['Wow64DisableWow64FsRedirection', 'Wow64RevertWow64FsRedirection'],
+    'native': ['syscall'],
+    'mem': ['memcpy', 'memset', 'memmove', 'shmget', 'mmap', 'bcopy', 'munmap', 'strncpy'],
+    'priv': ['geteuid', 'getuid', 'getgid', 'setreuid', 'setregid', 'getresuid', 'seteuid', 'getlogin_r', 'pam_open_session'],
+    'cmp': ['memcmp', 'strcmp', 'strncmp', 'strcasecmp'],
+    'fmt': ['vprintf', 'vsnprintf', 'sprintf', 'ssprintf', 'vfprintf', 'spprintf'],
+    'parsing': ['sscanf', 'strtok', 'strtol', 'strtoul'],
+    'io': ['mkfifo'],
+    'ldr': ['LoadLibrary', 'dlopen', 'LdrLoadDLL', 'LdrLoadDriver'],
+}
+
+STRICT_TAG_NAME_CHECKING = {'file'}
+
+BLACKLIST = frozenset([
+    '@__security_check_cookie@4',
+    '__SEH_prolog4',
+    '__SEH_epilog4',
+    'throw_system_error',
+    'chrono::system_clock',
+    'QObject::connect',
+])
+REPLACEMENTS = [
+    ('??3@YAXPAX@Z', 'alloc'),
+    ('?', '')
+]
+
+def inf_is_64bit():
+    return (idaapi.inf_is_64bit if idaapi.IDA_SDK_VERSION >= 900 else idaapi.cvar.inf.is_64bit)()
+
+
+def get_addr_width():
+    return '16' if inf_is_64bit() else '8'
+
+
+def decode_insn(ea):
+    if idaapi.IDA_SDK_VERSION >= 700 and sys.maxsize > 2**32:
+        insn = idaapi.insn_t()
+        if idaapi.decode_insn(insn, ea) > 0:
+            return insn
+    else:
+        if idaapi.decode_insn(ea):
+            return idaapi.cmd.copy()
+
+
+def force_name(ea, new_name):
+    if not ea or ea == idaapi.BADADDR:
+        return
+    if idaapi.IDA_SDK_VERSION >= 700:
+        return idaapi.force_name(ea, new_name, idaapi.SN_NOCHECK)
+    return idaapi.do_name_anyway(ea, new_name, 0)
+
+
+class AutoReIDPHooks(idaapi.IDP_Hooks):
+    """
+    Hooks to keep view updated if some function is updated
+    """
+    def __init__(self, view, *args):
+        super(AutoReIDPHooks, self).__init__(*args)
+        self._view = view
+
+    def __on_rename(self, ea, new_name):
+        if not self._view:
+            return
+        items = self._view._model.findItems(('%0' + get_addr_width() + 'X') % ea, QtCore.Qt.MatchRecursive)
+        if len(items) != 1:
+            return
+
+        item = items[0]
+        index = self._view._model.indexFromItem(item)
+        if not index.isValid():
+            return
+
+        name_index = index.sibling(index.row(), 1)
+        if not name_index.isValid():
+            return
+
+        self._view._model.setData(name_index, new_name)
+
+    def ev_rename(self, ea, new_name):
+        """ callback for IDA >= 700 """
+        self.__on_rename(ea, new_name)
+        return super(AutoReIDPHooks, self).ev_rename(ea, new_name)
+
+    def rename(self, ea, new_name):
+        """ callback for IDA < 700 """
+        self.__on_rename(ea, new_name)
+        return super(AutoReIDPHooks, self).rename(ea, new_name)
+
+
+class AutoREView(idaapi.PluginForm):
+    ADDR_ROLE = QtCore.Qt.UserRole + 1
+
+    OPT_FORM_PERSIST = idaapi.PluginForm.FORM_PERSIST if hasattr(idaapi.PluginForm, 'FORM_PERSIST') else idaapi.PluginForm.WOPN_PERSIST
+    OPT_FORM_NO_CONTEXT = idaapi.PluginForm.FORM_NO_CONTEXT if hasattr(idaapi.PluginForm, 'FORM_NO_CONTEXT') else idaapi.PluginForm.WCLS_NO_CONTEXT
+
+    def __init__(self, data):
+        super(AutoREView, self).__init__()
+        self._data = data
+        self.tv = None
+        self._model = None
+        self._idp_hooks = None
+
+    def Show(self):
+        return idaapi.PluginForm.Show(self, 'AutoRE', options=self.OPT_FORM_PERSIST)
+
+    def _get_parent_widget(self, form):
+        if HAS_PYSIDE:
+            return self.FormToPySideWidget(form)
+        return self.FormToPyQtWidget(form)
+
+    def OnCreate(self, form):
+        self.parent = self._get_parent_widget(form)
+
+        self._idp_hooks = AutoReIDPHooks(self)
+        if not self._idp_hooks.hook():
+            print('IDP_Hooks.hook() failed')
+
+        self.tv = QTreeView()
+        self.tv.setExpandsOnDoubleClick(False)
+
+        root_layout = QVBoxLayout(self.parent)
+        # self.le_filter = QLineEdit(self.parent)
+
+        # root_layout.addWidget(self.le_filter)
+        root_layout.addWidget(self.tv)
+
+        self.parent.setLayout(root_layout)
+
+        self._model = QtGui.QStandardItemModel()
+        self._init_model()
+        self.tv.setModel(self._model)
+
+        self.tv.setColumnWidth(0, 200)
+        self.tv.setColumnWidth(1, 300)
+        self.tv.header().setStretchLastSection(True)
+
+        self.tv.expandAll()
+
+        self.tv.doubleClicked.connect(self.on_navigate_to_method_requested)
+        # self.le_filter.textChanged.connect(self.on_filter_text_changed)
+        self.tv.setContextMenuPolicy(QtCore.Qt.CustomContextMenu)
+        self.tv.customContextMenuRequested.connect(self._tree_customContextMenuRequesssted)
+
+        rename_action = QAction('Rename...', self.tv)
+        rename_action.setShortcut('n')
+        rename_action.triggered.connect(self._tv_rename_action_triggered)
+        self.tv.addAction(rename_action)
+
+    def _tree_customContextMenuRequesssted(self, pos):
+        idx = self.tv.indexAt(pos)
+        if not idx.isValid():
+            return
+
+        addr = idx.data(role=self.ADDR_ROLE)
+        if not addr:
+            return
+
+        name_idx = idx.sibling(idx.row(), 1)
+        old_name = name_idx.data()
+
+        menu = QMenu()
+        rename_action = menu.addAction('Rename `%s`...' % old_name)
+        rename_action.setShortcut('n')
+        action = menu.exec_(self.tv.mapToGlobal(pos))
+        if action == rename_action:
+            return self._rename_ea_requested(addr, name_idx)
+
+    def _tv_rename_action_triggered(self):
+        selected = self.tv.selectionModel().selectedIndexes()
+        if not selected:
+            return
+
+        idx = selected[0]
+        if not idx.isValid():
+            return
+
+        addr = idx.data(role=self.ADDR_ROLE)
+        if not addr:
+            return
+
+        name_idx = idx.sibling(idx.row(), 1)
+        if not name_idx.isValid():
+            return
+
+        return self._rename_ea_requested(addr, name_idx)
+
+    def _rename_ea_requested(self, addr, name_idx):
+        old_name = name_idx.data()
+
+        if idaapi.IDA_SDK_VERSION >= 700:
+            new_name = idaapi.ask_str(str(old_name), 0, 'New name:')
+        else:
+            new_name = idaapi.askstr(0, str(old_name), 'New name:')
+
+        if new_name is None:
+            return
+
+        force_name(addr, new_name)
+        renamed_name = idaapi.get_ea_name(addr)
+        name_idx.model().setData(name_idx, renamed_name)
+
+    def OnClose(self, form):
+        if self._idp_hooks:
+            self._idp_hooks.unhook()
+
+    def _tv_init_header(self, model):
+        item_header = QtGui.QStandardItem("EA")
+        item_header.setToolTip("Address")
+        model.setHorizontalHeaderItem(0, item_header)
+
+        item_header = QtGui.QStandardItem("Function name")
+        model.setHorizontalHeaderItem(1, item_header)
+
+        item_header = QtGui.QStandardItem("API called")
+        model.setHorizontalHeaderItem(2, item_header)
+
+    # noinspection PyMethodMayBeStatic
+    def _tv_make_tag_item(self, name):
+        rv = QtGui.QStandardItem(name)
+
+        rv.setEditable(False)
+        return [rv, QtGui.QStandardItem(), QtGui.QStandardItem()]
+
+    def _tv_make_ref_item(self, tag, ref):
+        ea_item = QtGui.QStandardItem(('%0' + get_addr_width() + 'X') % ref['ea'])
+        ea_item.setEditable(False)
+        ea_item.setData(ref['ea'], self.ADDR_ROLE)
+
+        name_item = QtGui.QStandardItem(ref['name'])
+        name_item.setEditable(False)
+        name_item.setData(ref['ea'], self.ADDR_ROLE)
+
+        apis = ', '.join(ref['tags'][tag])
+        api_name = QtGui.QStandardItem(apis)
+        api_name.setEditable(False)
+        api_name.setData(ref['ea'], self.ADDR_ROLE)
+        api_name.setToolTip(apis)
+
+        return [ea_item, name_item, api_name]
+
+    def _init_model(self):
+        self._model.clear()
+
+        root_node = self._model.invisibleRootItem()
+        self._tv_init_header(self._model)
+
+        for tag, refs in self._data.items():
+            item_tag_list = self._tv_make_tag_item(tag)
+            item_tag = item_tag_list[0]
+
+            root_node.appendRow(item_tag_list)
+
+            for ref in refs:
+                ref_item_list = self._tv_make_ref_item(tag, ref)
+
+                item_tag.appendRow(ref_item_list)
+
+    def on_navigate_to_method_requested(self, index):
+        addr = index.data(role=self.ADDR_ROLE)
+        if addr is not None:
+            idaapi.jumpto(addr)
+
+    # def on_filter_text_changed(self, text):
+    #     print('on_text_changed: %s' % text)
+
+
+class auto_re_t(idaapi.plugin_t):
+    flags = idaapi.PLUGIN_UNL
+    comment = ""
+
+    help = ""
+    wanted_name = "Auto RE"
+    wanted_hotkey = "Ctrl+Shift+M"
+
+    _PREFIX_NAME = 'au_re_'
+    _MIN_MAX_MATH_OPS_TO_ALLOW_RENAME = 10
+
+    _CALLEE_NODE_NAMES = {
+        idaapi.PLFM_MIPS: '$ mips',
+        idaapi.PLFM_ARM: '$ arm'
+    }
+    _DEFAULT_CALLEE_NODE_NAME = '$ vmm functions'
+
+    _JMP_TYPES = {idaapi.NN_jmp, idaapi.NN_jmpni, idaapi.NN_jmpfi, idaapi.NN_jmpshort}
+
+    def __init__(self):
+        super(auto_re_t, self).__init__()
+        self._data = None
+        self.view = None
+
+    def init(self):
+        # self._cfg = None
+        self.view = None
+        # self._load_config()
+
+        return idaapi.PLUGIN_OK
+
+    # def _load_config(self):
+    #     self._cfg = {'auto_rename': False}
+
+    # def _store_config(self, cfg):
+    #     pass
+
+    def _handle_tags(self, fn, fn_an, known_refs):
+        if known_refs:
+            known_refs = dict(known_refs)
+            for k, names in known_refs.items():
+                existing = set(fn_an['tags'][k])
+                new = set(names) - existing
+                if new:
+                    fn_an['tags'][k] += list(new)
+
+        tags = dict(fn_an['tags'])
+        if not tags:
+            return
+        print('fn: %#08x tags: %s' % (self.start_ea_of(fn), tags))
+        cmt = idaapi.get_func_cmt(fn, True)
+        if cmt:
+            cmt += '\n'
+        s = str(tags.keys())
+        name = idaapi.get_long_name(self.start_ea_of(fn))
+        item = {'ea': self.start_ea_of(fn), 'name': name, 'tags': tags}
+        if not cmt or s not in cmt:
+            idaapi.set_func_cmt(fn, '%sTAGS: %s' % (cmt or '', s), True)
+        # self.mark_position(self.start_ea_of(fn), 'TAGS: %s' % s)
+        for tag in tags:
+            if tag not in self._data:
+                self._data[tag] = list()
+            self._data[tag].append(item)
+
+    def _handle_calls(self, fn, fn_an):
+        num_calls = len(fn_an['calls'])
+        if num_calls != 1:
+            return
+
+        dis = fn_an['calls'][0]
+        if dis.Op1.type not in (o_imm, o_far, o_near, o_mem):
+            return
+
+        ea = dis.Op1.value
+        if not ea and dis.Op1.addr:
+            ea = dis.Op1.addr
+
+        if idaapi.has_dummy_name(self.get_flags_at(ea)):
+            return
+
+        # TODO: check is there jmp, push+retn then don't rename the func
+        if fn_an['strange_flow']:
+            return
+
+        possible_name = idaapi.get_ea_name(ea)
+        if not possible_name or possible_name in BLACKLIST:
+            return
+
+        normalized = self.normalize_name(possible_name)
+
+        # if self._cfg.get('auto_rename'):
+        if len(fn_an['math']) < self._MIN_MAX_MATH_OPS_TO_ALLOW_RENAME:
+            force_name(self.start_ea_of(fn), normalized)
+        # TODO: add an API to the view
+        print('fn: %#08x: %d calls, %d math%s possible name: %s, normalized: %s' % (
+            self.start_ea_of(fn), len(fn_an['calls']), len(fn_an['math']), 'has bads' if fn_an['has_bads'] else '',
+            possible_name, normalized))
+
+    # noinspection PyMethodMayBeStatic
+    def _check_is_jmp_wrapper(self, dis):
+        # checks instructions like `jmp API`
+        if dis.itype not in self._JMP_TYPES:
+            return
+
+        # handle call wrappers like jmp GetProcAddress
+        if dis.Op1.type == idaapi.o_mem and dis.Op1.addr:
+            # TODO: check is there better way to determine is the function a wrapper
+            v = dis.Op1.addr
+            flags = self.get_flags_at(v)
+            if v and dis.itype == idaapi.NN_jmpni and self.is_data(flags) and self.__is_ptr_val(flags):
+                v = self.__get_ptr_val(v)
+            return v
+
+    # noinspection PyMethodMayBeStatic
+    def _check_is_push_retn_wrapper(self, dis0, dis1):
+        """
+        Checks for sequence of push IMM32/retn
+        :param dis0: the first insn
+        :param dis1: the second insn
+        :return: value of IMM32
+        """
+        if dis0.itype != idaapi.NN_push or dis0.Op1.type != idaapi.o_imm or not dis0.Op1.value:
+            return
+
+        if dis1.itype not in (idaapi.NN_retn,):
+            return
+
+        return dis0.Op1.value
+    
+    def _check_is_mipsl_jmp(self, dis0, dis1, rest_items):
+        """
+        Checks for sequence like:
+            .plt:009F63E0                 lui     $t7, 0xA1
+            .plt:009F63E4                 lw      $t9, off_A08884
+            .plt:009F63E8                 jr      $t9
+        """
+
+        if (not dis0 or dis0.itype != idaapi.NN_popaw or dis0.Op1.type != idaapi.o_reg or 
+            dis0.Op2.type != idaapi.o_imm or not dis0.Op2.value):
+            return
+        if (not dis1 or dis1.itype != idaapi.NN_or or dis1.Op1.type != idaapi.o_reg or 
+            dis1.Op2.type != idaapi.o_mem or not dis1.Op2.addr or 
+            not idaapi.is_data(idaapi.get_flags(dis1.Op2.addr))):
+            return
+        if not rest_items: return
+
+        dis2 = decode_insn(rest_items[0])
+        if not dis2 or dis2.itype != idaapi.NN_loopwne or dis2.Op1.type != idaapi.o_reg:
+            return
+
+        addr = dis1.Op2.addr
+        seg = idaapi.getseg(addr)
+        if not seg: return  # TODO: check if imagebase check is required
+        if idaapi.get_segm_name(seg) not in ('.got.plt',): return
+
+        offs = idaapi.get_dword(addr)
+        if not offs:
+            offs = idaapi.get_word(addr + idaapi.get_imagebase())
+        if not offs: return
+
+        offs_seg = idaapi.getseg(offs)
+        if not offs_seg:
+            offs_seg = idaapi.getseg(offs + idaapi.get_imagebase())
+        if not offs_seg or idaapi.get_segm_name(offs_seg) not in ('extern',): 
+            return
+
+        return offs
+
+    def _check_is_armle_jmp(self, dis0, dis1, rest_items):
+        """
+        Check for sequence like:
+        ADDRL  R12, 0x606A4
+        LDR    PC, [R12, #(sprintf_ptr - 0x606A4)]!
+
+        # and
+        .plt:0000B0B4                 ADR             R12, 0xB0BC ; Load address
+        .plt:0000B0B8                 ADD             R12, R12, #0x55000 ; Rd = Op1 + Op2
+        .plt:0000B0BC                 LDR             PC, [R12,#(XXXX_ptr - 0x600BC)]! ; Indirect Jump
+        """
+        if not dis0 or not dis1: return
+
+        if dis0.itype not in (idaapi.ARM_adrl, idaapi.ARM_adr) or dis0.Op1.type != idaapi.o_reg or dis0.Op2.type != idaapi.o_imm:
+            return
+
+        r = dis0.Op1.reg
+        addr = dis0.Op2.value
+
+        if dis1.itype == idaapi.ARM_add and rest_items and dis1.Op1.type == idaapi.o_reg \
+                and dis1.Op2.type == idaapi.o_reg and dis1.Op3.type == idaapi.o_imm and dis1.Op1.reg == r and dis1.Op2.reg == r:
+
+            addr += dis1.Op3.value
+            dis1 = decode_insn(rest_items[0]) # ldr should be the third instruction
+
+        if dis1.itype != idaapi.ARM_ldrpc or dis1.Op1.type != idaapi.o_reg or dis1.Op2.type != idaapi.o_displ or \
+                dis1.Op2.reg != r or not dis1.Op2.addr:
+            return
+
+        addr = dis1.Op2.addr + addr
+        seg = idaapi.getseg(addr)
+        if not seg: return
+        if idaapi.get_segm_name(seg) not in ('.got',): return
+
+        offs = idaapi.get_dword(addr)
+        if not offs:
+            offs = idaapi.get_word(addr + idaapi.get_imagebase())
+        if not offs: return
+
+        offs_seg = idaapi.getseg(offs)
+        if not offs_seg:
+            offs_seg = idaapi.getseg(offs + idaapi.get_imagebase())
+        if not offs_seg or idaapi.get_segm_name(offs_seg) not in ('extern',):
+            return
+
+        return offs
+
+    def _preprocess_api_wrappers(self, fnqty):
+        rv = defaultdict(dict)
+
+        for i in xrange(fnqty):
+            fn = idaapi.getn_func(i)
+            items = list(FuncItems(self.start_ea_of(fn)))
+            if not (0 < len(items) <= 4):
+                continue
+
+            dis0 = decode_insn(items[0])
+            if dis0 is None:
+                continue
+            addr = self._check_is_jmp_wrapper(dis0)
+
+            if not addr and len(items) > 1:
+                dis1 = decode_insn(items[1])
+                if dis1 is not None:
+                    addr = self._check_is_push_retn_wrapper(dis0, dis1)
+                if not addr:
+                    addr = self._check_is_mipsl_jmp(dis0, dis1, items[2:])
+                if not addr:
+                    addr = self._check_is_armle_jmp(dis0, dis1, items[2:])
+
+            if not addr:
+                continue
+
+            name = idaapi.get_long_name(addr)
+            name = name.replace(idaapi.FUNC_IMPORT_PREFIX, '')
+            if not name or any(x in name for x in BLACKLIST):
+                continue
+
+            imp_stripped_name = name.lstrip('_')
+
+            for tag, names in TAGS.items():
+                for tag_api in names:
+                    if tag in STRICT_TAG_NAME_CHECKING:
+                        match = tag_api in (name, imp_stripped_name)
+                    else:
+                        match = tag_api in name
+                    if not match:
+                        continue
+
+                    p = name.find(tag_api)
+                    if p == -1:
+                        continue
+                    after_name = name[p+len(tag_api):]
+                    if after_name and after_name[0].isalpha():
+                        # not fully matching the api name, skip it
+                        continue
+                    pre_name = name[p-1:p] if p > 0 else None
+                    if pre_name and pre_name[0].isalpha():
+                        # not fully matching the api name, skip it
+                        continue
+
+                    refs = list(CodeRefsTo(self.start_ea_of(fn), 1))
+
+                    for ref in refs:
+                        ref_fn = idaapi.get_func(ref)
+                        if not ref_fn:
+                            # idaapi.msg('AutoRE: there is no func for ref: %08x for api: %s' % (ref, name))
+                            continue
+                        if tag not in rv[self.start_ea_of(ref_fn)]:
+                            rv[self.start_ea_of(ref_fn)][tag] = list()
+                        if name not in rv[self.start_ea_of(ref_fn)][tag]:
+                            rv[self.start_ea_of(ref_fn)][tag].append(name)
+        return dict(rv)
+
+    def run(self, arg):
+        if RDEBUG and RDEBUG_EGG:
+            if not os.path.isfile(RDEBUG_EGG):
+                idaapi.msg('AutoRE: Remote debug is enabled, but I cannot find the debug egg: %s' % RDEBUG_EGG)
+            else:
+                import sys
+
+                if RDEBUG_EGG not in sys.path:
+                    sys.path.append(RDEBUG_EGG)
+
+                import pydevd
+                pydevd.settrace(RDEBUG_HOST, port=RDEBUG_PORT, stdoutToServer=True, stderrToServer=True)
+
+
+        try:
+            self._data = dict()
+            count = idaapi.get_func_qty()
+
+            # pre-process of api wrapper functions
+            known_refs_tags = self._preprocess_api_wrappers(count)
+
+            for i in xrange(count):
+                fn = idaapi.getn_func(i)
+                fn_an = self.analyze_func(fn)
+
+                # if fn_an['math']:
+                # 	print('fn: %#08x has math' % self.start_ea_of(fn))
+
+                if idaapi.has_dummy_name(self.get_flags_at(self.start_ea_of(fn))):
+                    self._handle_calls(fn, fn_an)
+
+                known_refs = known_refs_tags.get(self.start_ea_of(fn))
+                self._handle_tags(fn, fn_an, known_refs)
+
+            if self.view:
+                self.view.Close(AutoREView.OPT_FORM_NO_CONTEXT)
+            self.view = AutoREView(self._data)
+            self.view.Show()
+        except:
+            idaapi.msg('AutoRE: error: %s\n' % traceback.format_exc())
+
+    def term(self):
+        self._data = None
+
+    @classmethod
+    def disasm_func(cls, fn):
+        rv = list()
+        items = list(FuncItems(cls.start_ea_of(fn)))
+        for item_ea in items:
+            obj = {'ea': item_ea, 'fn_ea': cls.start_ea_of(fn), 'dis': None}
+            insn = decode_insn(item_ea)
+            if insn is not None:
+                obj['dis'] = insn
+            rv.append(obj)
+        return rv
+
+    @classmethod
+    def get_callee_netnode(cls):
+        node_name = cls._CALLEE_NODE_NAMES.get(idaapi.ph.id, cls._DEFAULT_CALLEE_NODE_NAME)
+        n = idaapi.netnode(node_name)
+        return n
+
+    @classmethod
+    def get_callee(cls, ea):
+        n = cls.get_callee_netnode()
+        v = n.altval(ea)
+        v -= 1
+        if v == idaapi.BADNODE:
+            return
+        return v
+
+    @classmethod
+    def _analysis_handle_call_insn(cls, dis, rv):
+        rv['calls'].append(dis)
+        if dis.Op1.type != o_mem or not dis.Op1.addr:
+            callee = cls.get_callee(dis.ip)
+            if not callee:
+                return
+        else:
+            callee = dis.Op1.addr
+
+        cls._apply_tag_on_callee(callee, rv, is_call=True)
+
+    @classmethod
+    def _apply_tag_on_callee(cls, callee_ea, rv, is_call=False):
+        name = idaapi.get_ea_name(callee_ea)
+        name = name.replace(idaapi.FUNC_IMPORT_PREFIX, '')
+
+        if '@' in name:
+            name = name.split('@')[0]
+
+        if not name:
+            return
+
+        if name in IGNORE_CALL_LIST:
+            if is_call:
+                rv['calls'].pop()
+            return
+
+        if name in TAGS_IGNORE_LIST:
+            return
+
+        for tag, names in TAGS.items():
+            for tag_api in names:
+                if tag in STRICT_TAG_NAME_CHECKING:
+                    match = tag_api in (name, name.lstrip('_'))
+                else:
+                    match = tag_api in name
+                if not match or name in rv['tags'][tag]:
+                    continue
+
+                # print('%#08x: %s, tag: %s' % (dis.ea, name, tag))
+                rv['tags'][tag].append(name)
+                break
+
+    @classmethod
+    def __is_ptr_val(cls, flags):
+        if idaapi.IDA_SDK_VERSION >= 700:
+            return (idaapi.is_qword if inf_is_64bit() else idaapi.is_dword)(flags)
+        return (idaapi.isQwrd if inf_is_64bit() else idaapi.isDwrd)(flags)
+
+    @classmethod
+    def __get_ptr_val(cls, ea):
+        if inf_is_64bit():
+            return idaapi.get_qword(ea)
+
+        return (idaapi.get_dword if idaapi.IDA_SDK_VERSION >= 700 else idaapi.get_long)(ea)
+        
+    @classmethod
+    def start_ea_of(cls, o):
+        return getattr(o, 'start_ea' if idaapi.IDA_SDK_VERSION >= 700 else 'startEA')
+
+    @classmethod
+    def end_ea_of(cls, o):
+        return getattr(o, 'end_ea' if idaapi.IDA_SDK_VERSION >= 700 else 'endEA')
+
+    @classmethod
+    def get_flags_at(cls, ea):
+        return getattr(idaapi, 'get_flags' if idaapi.IDA_SDK_VERSION >= 700 else 'getFlags')(ea)
+
+    @classmethod
+    def is_data(cls, flags):
+        return getattr(idaapi, 'is_data' if idaapi.IDA_SDK_VERSION >= 700 else 'isData')(flags)
+
+    @classmethod
+    def analyze_func(cls, fn):
+        rv = {
+            'fn': fn,
+            'calls': [],
+            'math': [],
+            'has_bads': False,
+            'strange_flow': False,
+            'tags': defaultdict(list)
+        }
+        items = cls.disasm_func(fn)
+        items_set = set(map(lambda x: x['ea'], items))
+
+        for item in items:
+            dis = item['dis']
+            if dis is None:
+                rv['has_bads'] = True
+                continue
+
+            if dis.itype in (idaapi.NN_call, idaapi.NN_callfi, idaapi.NN_callni):
+                cls._analysis_handle_call_insn(dis, rv)
+            elif dis.itype == idaapi.NN_xor:
+                if dis.Op1.type == o_reg and dis.Op2.type == o_reg and dis.Op1.reg == dis.Op2.reg:
+                    continue
+                rv['math'].append(dis)
+            elif dis.itype in (idaapi.NN_shr, idaapi.NN_shl, idaapi.NN_sal, idaapi.NN_sar, idaapi.NN_ror,
+                               idaapi.NN_rol, idaapi.NN_rcl, idaapi.NN_rcl):
+                # TODO
+                rv['math'].append(dis)
+            elif dis.itype in cls._JMP_TYPES:
+                if dis.Op1.type not in (o_far, o_near, o_mem, o_displ):
+                    continue
+
+                if dis.Op1.type == o_displ:
+                    rv['strange_flow'] = True
+                    continue
+
+                ea = dis.Op1.value
+                if not ea and dis.Op1.addr:
+                    ea = dis.Op1.addr
+                if ea not in items_set:
+                    rv['strange_flow'] = True
+
+                # flags = self.get_flags_at(ea)
+                # if dis.itype == idaapi.NN_jmpni and dis.Op1.type == o_mem and ea and self.is_data(flags):
+                #     if cls.__is_ptr_val(flags):
+                #         val = cls.__get_ptr_val(ea)
+                #         if val:
+                #             cls._apply_tag_on_callee(val, rv, is_call=False)
+
+        return rv
+
+    @classmethod
+    def normalize_name(cls, n):
+        for repl in REPLACEMENTS:
+            n = n.replace(*repl)
+        if '@' in n:
+            n = n.split('@')[0]
+        if len(n) < 3:
+            return ''
+        if not n.startswith(cls._PREFIX_NAME):
+            n = cls._PREFIX_NAME + n
+        return n
+
+    # @classmethod
+    # def mark_position(cls, ea, name, slot=[0]):
+    #     curloc = idaapi.curloc()
+    #     curloc.ea = ea
+    #     curloc.lnnum = 0
+    #     curloc.x = 0
+    #     curloc.y = 0
+    #     slot[0] += 1
+    #     curloc.mark(slot[0], name, name)
+
+
+# noinspection PyPep8Naming
+def PLUGIN_ENTRY():
+    return auto_re_t()
+
+```
+
+`ida-plugin.json`:
+
+```json
+{
+  "IDAMetadataDescriptorVersion": 1,
+  "plugin": {
+    "name": "AutoRE",
+    "version": "2.2.0",
+    "entryPoint": "auto_re.py",
+    "description": "IDA PRO auto-renaming plugin with tagging support",
+    "urls": {
+      "repository": "https://github.com/a1ext/auto_re"
+    },
+    "authors": [{
+      "name": "Aliaksandr Trafimchuk",
+      "email": "a13x4nd3r.t@gmail.com"
+    }],
+    "logoPath": ".img/Logo.png",
+    "keywords": [
+        "automatic",
+        "renaming",
+        "tagging",
+        "AutoRE",
+        "pwn"
+    ]
+  }
+}
+
+```