Skip to content

Instantly share code, notes, and snippets.

@av-gantimurov
Last active September 7, 2025 08:56
Show Gist options
  • Select an option

  • Save av-gantimurov/33e41f6139ac0cf3c5497e69a3b35e38 to your computer and use it in GitHub Desktop.

Select an option

Save av-gantimurov/33e41f6139ac0cf3c5497e69a3b35e38 to your computer and use it in GitHub Desktop.
IDAPro prototype converter
import re
def get_ida_proto(prototype: str) -> str:
output = prototype
replacements = {
r'\bNTSYSAPI\b': '',
r'\bWINBASEAPI\b': '',
r'\bNTAPI\b': '__cdecl',
r'\bWINAPI\b': '__stdcall',
r'\bIN\b': '',
r'\bOUT\b': '',
r'\bOPTIONAL\b': '',
r'\b_In_\b': '',
r'\b_In_opt_\b': '',
r'\b_Out_\b': '',
r'\b_Out_opt_\b': '',
r'\b_Inout_\b': '',
r'\b_Ret_maybenull_\b': '',
r'\b_Outptr_\b': '',
}
for pattern, repl in replacements.items():
output = re.sub(pattern, repl, output)
# Remove specific bracketed phrases
bracketed_phrases = [
r'\[in\]',
r'\[out\]',
r'\[in, out\]',
r'\[in, optional\]',
r'\[out, optional\]',
r'\[in, out, optional\]'
]
for phrase in bracketed_phrases:
output = re.sub(phrase, '', output)
output = re.sub(r'//[^\n]+', '', output)
output = re.sub(r'/\*(.*?)\*/', '', output)
output = re.sub(r'\s+', ' ', output)
output = output.replace(" ,", ",")
output = output.replace("( ", "(")
output = output.replace(" )", ")")
return output.strip()
if __name__ == "__main__":
import sys
if len(sys.argv) == 1:
print(f"usage: {sys.argv[0]} <MSDN_PROTO>")
else:
print(get_ida_proto(sys.argv[1]))
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment