Skip to main content
Bounty Ended with 50 reputation awarded by Willi Ballenthin
hm? no syntax highlighting? not even when I ask?
Source Link
Jongware
  • 2.4k
  • 2
  • 17
  • 30

There doesn't seem to be an elegant solution to this. Looks like if you would be writing a plugin in C you would be able to call sib_base, sib_index, sib_scale to get the info.

Here's how you could do it in pythonPython.

from idautils import DecodeInstruction
from idaapi import get_reg_name

ea = 0x20AC5 # Assuming this ea is a lea
i = DecodeInstruction(ea)

hasSIB = i.Op2.specflag1
sib = i.Op2.specflag2

if hasSIB:
    base = sib  & 7
    index = (sib >> 3) & 7
    scale = (sib >> 6) & 3
    size = 4 if i.Op2.dtyp == idaapi.dt_dword else 8
    print '[{} + {}{} + {:x}]'.format(
        get_reg_name(base, size),
        get_reg_name(index, size),
        '*{}'.format(2**scale) if scale else '',
        i.Op2.addr
    )
from idautils import DecodeInstruction
from idaapi import get_reg_name

ea = 0x20AC5 # Assuming this ea is a lea
i = DecodeInstruction(ea)

hasSIB = i.Op2.specflag1
sib = i.Op2.specflag2

if hasSIB:
    base = sib  & 7
    index = (sib >> 3) & 7
    scale = (sib >> 6) & 3
    size = 4 if i.Op2.dtyp == idaapi.dt_dword else 8
    print '[{} + {}{} + {:x}]'.format(
        get_reg_name(base, size),
        get_reg_name(index, size),
        '*{}'.format(2**scale) if scale else '',
        i.Op2.addr
    )

Example Output: [ebx + eax*4 + 8c]

There doesn't seem to be an elegant solution to this. Looks like if you would be writing a plugin in C you would be able to call sib_base, sib_index, sib_scale to get the info.

Here's how you could do it in python.

from idautils import DecodeInstruction
from idaapi import get_reg_name

ea = 0x20AC5 # Assuming this ea is a lea
i = DecodeInstruction(ea)

hasSIB = i.Op2.specflag1
sib = i.Op2.specflag2

if hasSIB:
    base = sib  & 7
    index = (sib >> 3) & 7
    scale = (sib >> 6) & 3
    size = 4 if i.Op2.dtyp == idaapi.dt_dword else 8
    print '[{} + {}{} + {:x}]'.format(
        get_reg_name(base, size),
        get_reg_name(index, size),
        '*{}'.format(2**scale) if scale else '',
        i.Op2.addr
    )

Example Output: [ebx + eax*4 + 8c]

There doesn't seem to be an elegant solution to this. Looks like if you would be writing a plugin in C you would be able to call sib_base, sib_index, sib_scale to get the info.

Here's how you could do it in Python.

from idautils import DecodeInstruction
from idaapi import get_reg_name

ea = 0x20AC5 # Assuming this ea is a lea
i = DecodeInstruction(ea)

hasSIB = i.Op2.specflag1
sib = i.Op2.specflag2

if hasSIB:
    base = sib  & 7
    index = (sib >> 3) & 7
    scale = (sib >> 6) & 3
    size = 4 if i.Op2.dtyp == idaapi.dt_dword else 8
    print '[{} + {}{} + {:x}]'.format(
        get_reg_name(base, size),
        get_reg_name(index, size),
        '*{}'.format(2**scale) if scale else '',
        i.Op2.addr
    )

Example Output: [ebx + eax*4 + 8c]

Source Link
Bambu
  • 556
  • 2
  • 8

There doesn't seem to be an elegant solution to this. Looks like if you would be writing a plugin in C you would be able to call sib_base, sib_index, sib_scale to get the info.

Here's how you could do it in python.

from idautils import DecodeInstruction
from idaapi import get_reg_name

ea = 0x20AC5 # Assuming this ea is a lea
i = DecodeInstruction(ea)

hasSIB = i.Op2.specflag1
sib = i.Op2.specflag2

if hasSIB:
    base = sib  & 7
    index = (sib >> 3) & 7
    scale = (sib >> 6) & 3
    size = 4 if i.Op2.dtyp == idaapi.dt_dword else 8
    print '[{} + {}{} + {:x}]'.format(
        get_reg_name(base, size),
        get_reg_name(index, size),
        '*{}'.format(2**scale) if scale else '',
        i.Op2.addr
    )

Example Output: [ebx + eax*4 + 8c]