0

I'm iterating through a list of heads returned by the Heads() function, and for each head I want to check if the address contains a pointer (specifically a pointer to code).

I've tried using the functions here but none of them seem to be relevant.

2

In idapython :

idc.isOff0(idc.GetFlags(your_ea)) - checks if the operand 0 of the entity at your_ea is the offset (which means pointer). dd and dq are the valid entities for such a request.

idc.isDword(idc.GetFlags(your_ea)) or idc.isQword(idc.GetFlags(your_ea)) checks if this head defined as a value of corresponding size.

If this head's content is not marked as an offset, but you still want to check it - you can get its value and check it against code segment borders.

| improve this answer | |
  • Thanks! Could you clarify why exactly "checks if the operand 0 of the entity at your_ea is the offset " means pointer? Also, is there a corresponding method for checking if the address is an array? Something like idc.isArray (I tried but it didn't work) – Derek Dec 15 '15 at 13:05
  • You can use 'idc.GetType(here())' to determine the type of the entity at the specific address. Data pseudo instructions like dd and dq have only one operand, and this is reason why OpOff0 and not OpOff1 is used. – w s Dec 15 '15 at 13:27
1

Using Sark you can:

import sark

for line in sark.lines():
    for xref in line.xrefs_from:
        if xref.type.is_flow:  # Make sure the xref is not to the next line.
            continue
        if sark.Line(xref.to).is_code:  # Check if the xref's target is code.
            print 'xref to code!'

See xrefs and lines documentation.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.