[FEATURE] Support imports.txt from PE-sieve

ifl.py

@@ -89,6 +89,15 @@ def va_to_rva(va: int) -> int:
     base = idaapi.get_imagebase()
     return va - base
 
+
+def _is_hex_str(s):
+    hex_digits = set("0123456789abcdefABCDEF")
+    for val in s:
+        if not (val in hex_digits):
+            return False
+    return True
+
+
 # Functions and args 
 
 def function_at(ea: int) -> Optional[int]:
@@ -911,6 +920,17 @@ def _saveFunctionsNames(self, file_name: Optional[str], ext: str) -> bool:
             return True
         return False
 
+    def _stripImportName(self, func_name) -> str:
+        """Keep only ImportName, without the DLL name, and the ordinal.
+        """
+        fn1 = func_name.split('.')
+        if len(fn1) >= 2:
+            func_name = fn1[1].strip()
+        fn1 = func_name.split('#')
+        if len(fn1) >= 2:
+            func_name = fn1[0].strip()
+        return func_name
+
     def _loadFunctionsNames(self, file_name: Optional[str], ext: str) -> Optional[Tuple[int, int]]:
         """Loads functions names from the given file into the internal mappings.
         Fromats: CSV (default), or TAG (PE-bear, PE-sieve compatibile).
@@ -921,6 +941,12 @@ def _loadFunctionsNames(self, file_name: Optional[str], ext: str) -> Optional[Tu
         curr_functions = self._listFunctionsAddr()
         delim = ","  # new delimiter (for CSV format)
         delim2 = ":"  # old delimiter
+        rva_indx = 0
+        cmt_indx = 1
+        is_imp_list = False
+        if ".imports.txt" in ext:
+            is_imp_list = True
+            cmt_indx = 2
         if ".tag" in ext:  # a TAG format was chosen
             delim2 = ";"
         functions = 0
@@ -934,21 +960,28 @@ def _loadFunctionsNames(self, file_name: Optional[str], ext: str) -> Optional[Tu
                 if len(fn) < 2:
                     continue
                 start = 0
+                addr_chunk = fn[rva_indx].strip()
+                if not _is_hex_str(addr_chunk):
+                    continue
                 try:
-                    start = int(fn[0].strip(), 16)
+                    start = int(addr_chunk, 16)
                 except ValueError:
                     # this line doesn't start from an offset, so skip it
                     continue
-                func_name = fn[1].strip()
+                func_name = fn[cmt_indx].strip()
                 if start < idaapi.get_imagebase():  # it is RVA
                     start = rva_to_va(start)  # convert to VA
 
-                if start in curr_functions:
+                if is_imp_list or (start in curr_functions):
+                    if is_imp_list:
+                        func_name = self._stripImportName(func_name)
+
                     if self.subDataManager.setFunctionName(start, func_name):
                         functions += 1
-                else:
-                    set_cmt(start, func_name, 1)  # set the name as a comment
-                    comments += 1
+                        continue
+
+                idaapi.set_func_cmt(start, func_name, 1)  # set the name as a comment
+                comments += 1
         return (functions, comments)
 
     def _setup_sorted_model(self, view, model) -> QtCore.QSortFilterProxyModel:
@@ -1237,7 +1270,7 @@ def importNames(self) -> None:
         """Imports functions list from a file.
         """
 
-        file_name, ext = QtWidgets.QFileDialog.getOpenFileName(None, "Import functions names", QtCore.QDir.homePath(), "CSV Files (*.csv);;TAG Files (*.tag);;All files (*)")
+        file_name, ext = QtWidgets.QFileDialog.getOpenFileName(None, "Import functions names", QtCore.QDir.homePath(), "CSV Files (*.csv);;TAG Files: PE-bear, PE-sieve compatibile (*.tag);;IMPORTS.TXT: generated by PE-sieve (*.imports.txt);;All files (*)")
         if file_name is not None and len(file_name) > 0:
             names = self._loadFunctionsNames(file_name, ext)
             if names is None: