Hello all

this script will rename all unknow functions to it's real name

like CreateForm , CloseForm .. etc

it searchs for sig of Events manager (this one Construct the Functions names and address )

it will works only for Delphi with GUI (components)


at first IDA didn't recognise it as Delphi file


now select the local debugger


then load the script file


it will load and Stop at EP

hit the Greeeen button or [F9]



now we have all the Functions named and have a BP [on]

the only issue here is it needs to run the file & the file to be unpacked

but if u can get the pattern address on unpacked file on memory it will work fine


https://github.com/Coldzer0/IDA-For-Delphi

i hope it will help reversing Delphi files

Peace