vivisect parse assembly

Question

I'm using the vivisect library to parse functions within a binary, the documentation for vivisect is quite slim and I was wondering if there was a way to get information about the assembly instructions. Example of something I'm looking for is whether or not a branch instructions operand is an absolute address or if there is any relative displacement addressing being used.

Does vivisect offer this or would I have to instead extract the bytes and process the assembly with something like capstone?

This is all statically done also, Im not interested in dynamic or instrumentation solutions.

Thanks,

Answer 1

Each disassembled instruction is an instance of an envi.Opcode. From there, you can access the individual operands as a list. ( ex. op.opers[0] )

Depending on your level of concern for architecture independence, you could check for specific opcode ( ie op.opcode == envi.archs.i386.opconst.INS_BRANCHCC for conditional branches ) and then check the op.opers[0].isImmed() or possibly isDiscrete() depending on exactly what you're looking for.

If you're looking for a bit more generic (architecture independent) solution, you could also use op.getBranches() (without specifying emu) and check if any of the (destva,flags) tuples returned have destva == None ( which means a branch was detected, but without emulation the destination virtual address is not known ) to find instructions with branches which are neither absolute nor instruction pointer relative.

However, you may also need to keep in mind that compiler optimizations may move an immediate address into a register to call later ( effectively immediate, but technically a register call ) which is why i would use the symbolic emulation subsystem to answer this kind of question. That would also have the benefit of giving you the actual algebraic expression used to calculate the target address.

happy hacking!

-visi