Colorize and disassemble byte sequences with IDA Pro and IDAPython

Question

Maybe someone could help me with the following problem:

I have an interesting byte sequence that I found within a MIPS ELF binary that exists on the hard drive. This byte sequence may be, for example, 9c 6c 3c 04 80 2d 24 84 85. Now I want to find this byte sequence with IDAPython. Therefore, I use the idc.FindBinary() function like so:

address = idc.FindBinary(0, SEARCH_DOWN, byte_sequence)

which finds the first occurrence of the byte sequence at address. In general I want to achieve two things:

1. I want to colorize the effected affected lines in the IDA View

2. I want to get the disassembled instructions

Currently there are two subproblems I want to solve:

1. The byte sequence may start within the instruction, for example, in a jal address the byte sequence starts at address instead of at jal. How can I search backwards to find the beginning of the instruction when the byte sequence started within the instruction? Colorizing works with:

   SetColor(address, CIC_ITEM, 0x208020)
   

2. If the byte sequence is 9 bytes long (as in the example above), how can I tell IDAPython to disassemble all 9 bytes. I would have to know how "long" the instructions are that IDAPython disassembles to get to the next instruction. What I know is that I can disassemble at a single addresses with:

   disasm = idc.GetDisasm(address)
   

Any help would be greatly appreciated!

Answer 1

You can easily do that using Sark:

# Get all the lines relevant to your bytes
for line in sark.lines(start=address, end=address + len(byte_sequence)):
    # For each line, color it, and print the disasm and the instruction length
    line.color = 0x123456
    print 'Line Size: {}\nLine Disasm: {}'.format(line.size, line.disasm)

You might need to add handling for cases where there is no disassembly (the bytes are data-bytes and not code).