Timeline for Ida Pro: parsing complex operand expression using IDAPython
Current License: CC BY-SA 3.0
5 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Jul 26, 2016 at 3:02 | comment | added | Orwellophile |
@Polynomial: that type of operand can be detected by GetOpnd(ea,1) == o_phrase and is probably the only kind of operand you would use regex for, except maybe for o_displ. Although, since you can't resolve it to an actual value, it's probably not likely to ever become an issue.
|
|
| Jul 26, 2016 at 2:17 | comment | added | Orwellophile |
@JasonGeffner (a) Easier to do regex GetOpnd(ea, 0) == [rsp+3F8h+var_3F8] (b) How to get the value of var_x (guessable) and arg_x (not su much) (c) In cases such as these (*register + displacement) just GetOperandValue(ea, 1) if GetOpType(ea, 1) == o_displ else None == 48.
|
|
| Feb 9, 2016 at 13:57 | comment | added | Jason Geffner | "This works until you hit a subtraction or multiplication" -- Yes, but that's not what the question asked :) | |
| Feb 9, 2016 at 10:20 | comment | added | Polynomial |
This works until you hit a subtraction or multiplication, e.g. mov edx, [eax+ecx*4]. Regex is not really a great option here, but unfortunately it doesn't seem like IDA really gives us much of a choice.
|
|
| Jun 1, 2015 at 14:22 | history | answered | Jason Geffner | CC BY-SA 3.0 |