1

How do I compare in IDA PRO if constants are located in the same functions or not.. like filter from all constants if I search for 2 constants or more I want to know which function(s) contain all the constants I want to search for, to eliminate searching through all constants with other constants to find matching functions.. (this is how I do it now it's very pain staking)

Constants window looks like this
constantsconstants2
How I do I mark red lines for bad addresses and blue ones for good ones haha
how i do



Is there any script or even better a plugin that does this job easier for me?

2
  • Which IDA version are you using ? Do I understand correctly that you want to find functions which are using similar constants set ?
    – w s
    Feb 7 '16 at 12:00
  • yes I want to find where certain constants have a link together, and best way is if they both in the same function.
    – SSpoke
    Feb 8 '16 at 5:56
1

IDAPython is the way to go when you want to do such things. I'd say something like that should work:

CONST_1 = "1234h"
CONST_2 = "ABCDh"
for func in Functions():
    got_first, got_second = False, False
    func_start = GetFunctionAttr(func,FUNCATTR_START)
    func_end = GetFunctionAttr(func,FUNCATTR_END)
    for ea in Heads(func_start, func_end):
        cur_line = GetDisasm(ea)
        got_first |= CONST_1 in cur_line
        got_second |= CONST_2 in cur_line
        if got_first and got_second:
            print "Found a match at 0x{:08x}".format(func_start)
            break

If your binary is really big and it's taking too long, you might think about optimizing the comparaison with operands.

0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.