---------------------------------------------------------------------------
fubar plugin v0.983 eternal beta: post-analysis tasks for ida pro by servil
supported ida versions: 4.90 and above till API change (tested on 5.2
without backward compatibility enforcement)
---------------------------------------------------------------------------

various additional idabase formatting and describing, main units:

    * resource parser and dereferencer
    * mfc message map parser
    * vcl object templates parser
    * more... see main dialog for available steps, most jobs obvious enough

notes (not only) for data formating: these auto-analysis options are
recommended to turn off before load to get better overall results
 - `coagulate data segments in final pass`
 - 'create function tails'

notes for mfc tool:
use external modules where the main module is storing resource outside. add as
many dlls as needed (most cases just one) in mfc tool options, all external
controls are added to lookup index. mfc tool only works if `load resource
section` is enabled on loader dialog.
ida typeinfo and comment is applied only in case of successfull renaming to
avoid messing with existing names.
there`s problem with re-used id's for two or more controls. if e.g. two dialogs
own control with same id, mfctool can't satisfactory determine whose's that
child. newly mfctool implements simple frequency analysis to query all possible
parents for all contained controls within one messagemap scope (the assumption
is one message is bound to just one parent, however the analysis is not 100% -
false parents may own all the ids too so consider to revise the list of
alternate candidate names in respective function comment).

notes for vcl parser:
additional runtime packages provide more naming facility of unknown methods
where not enough information is present in disassembly, however be sure to use
correnct version of runtimes, otherwise names may go set wrong or even ida may
krash (plugin traversing runtime paralelly along with disassembly, ie. expects
valid offset in runtime package where offset is in disassembly), for example
delphi7 targets only can use packages *70.bpl, etc. any interface table entries
found in registry by guid and respective vtable members will be renamed
accordingly to available typelib information. vcl parser will work on delphi
versions 3 or above, older versions are not detected properly (but who uses
them nowadays), delphi versions 3 and 4 are implemented but not tested properly
so minor variances in structures can happen.
hint: run vcl parser only immediately after new file is loaded. unlike ida`s
generic autoanalysis engine, vcl parser exactly knows names and format of data
structures so that wrong disassembly and names by processor module are reduced
considerably.

notes for resource decompiler:
resdec parses and references local resource by default. if the disassembly uses
resource from external module, use external parser in addition (see below). all
external resource will be added to lookup table and searched again (to invoke
external parser see below). necessary condition for local resource decompiler
is loader's dialog 'load resource section` option enabled (ie. resource segment
must be present in idabase).

to install copy fubar.plw and fubar.dat to ida plugs dir, to enable loading
resources from other modules, need to edit plugs.cfg manually:

   bind_extern_resource    fubar   0   1

known bugs and limitations:
shure!;)

servil


little changelog:

0.97 beta (07/15/2005)
+ added preferred language to mfctool and resource decompiler
! minor improvements and buxfixes

0.961 beta (05/04/2005)
! resource list should display descriptions correctly again
! apply signess didn't work

0.96 beta (05/01/2005)
* recompiled for ida 4.8
! slightly better resource api calls detection
! some minor changes i can't remember anymore
