3

Maybe someone could help me with the following problem:

I have an interesting byte sequence that I found within a MIPS ELF binary that exists on the hard drive. This byte sequence may be, for example, 9c 6c 3c 04 80 2d 24 84 85. Now I want to find this byte sequence with IDAPython. Therefore, I use the idc.FindBinary() function like so:

address = idc.FindBinary(0, SEARCH_DOWN, byte_sequence)

which finds the first occurrence of the byte sequence at address. In general I want to achieve two things:

  1. I want to colorize the effected affected lines in the IDA View

  2. I want to get the disassembled instructions

Currently there are two subproblems I want to solve:

  1. The byte sequence may start within the instruction, for example, in a jal address the byte sequence starts at address instead of at jal. How can I search backwards to find the beginning of the instruction when the byte sequence started within the instruction? Colorizing works with:

    SetColor(address, CIC_ITEM, 0x208020)
    
  2. If the byte sequence is 9 bytes long (as in the example above), how can I tell IDAPython to disassemble all 9 bytes. I would have to know how "long" the instructions are that IDAPython disassembles to get to the next instruction. What I know is that I can disassemble at a single addresses with:

    disasm = idc.GetDisasm(address)
    

Any help would be greatly appreciated!

  • 3
    Not 100% sure, but i seem to remember that MIPS instructions are always exactly 4 bytes, so you can just do some modulo calculations. Otherwise, PrevHead and NextHead are probably what you want (idc.PrevHead and idc.NextHead in IdaPython). – Guntram Blohm Nov 18 '15 at 9:40
3

You can easily do that using Sark:

# Get all the lines relevant to your bytes
for line in sark.lines(start=address, end=address + len(byte_sequence)):
    # For each line, color it, and print the disasm and the instruction length
    line.color = 0x123456
    print 'Line Size: {}\nLine Disasm: {}'.format(line.size, line.disasm)

You might need to add handling for cases where there is no disassembly (the bytes are data-bytes and not code).

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.