1

I need to get hanging instructions i.e instructions which are not under any functions in a dll through idapython script? it is available in brown color when seen through IDA pro.

1

This command will find the address if hanging instruction next to the ScreenEA() and print it.

import idaapi
import idc
addr = idaapi.find_not_func(ScreenEA(), 1)
if addr != idc.BADADDR: 
    print "0x%08x : %s" % (addr, idc.GetDisasm(addr))
else:
    print "Hanging instruction not found"

To print all the hanging instructions in the loaded binary, do the following:

import idaapi
import idc
addr = idaapi.find_not_func(0, 1)
while addr != idc.BADADDR:
    print "0x%08x : %s" % (addr, idc.GetDisasm(addr))
    addr = idaapi.find_not_func(addr, 1)
print "No more hanging instruction found"
| improve this answer | |
  • I want the exact instruction itself not address – Vicky Jun 29 '16 at 16:03
  • Updated an answer – w s Jun 29 '16 at 16:13
1

The naive solution will be to iterate over every instruction in the code and check if it is inside a function.

Using Sark

for line in sark.lines():
    if not line.is_code:
        # The line is not a code line, so we skip it.
        continue
    if sark.is_function(line.ea):
        # Line is inside a function, skip it.
        continue

    # The line is code outside a function. Print it.
    print line

Using standard IDAPython

import idaapi
import idc

def iter_all_lines():
    start = idaapi.cvar.inf.minEA
    end = idaapi.cvar.inf.maxEA

    item = idaapi.get_item_head(start)
    while item < end:
        yield item
        item += idaapi.get_item_size(item)


def iter_hanging_lines():
    for line in iter_all_lines():
        if not idaapi.isCode(idaapi.getFlags(line)):
            # The line is not a code line, so we skip it.
            continue

        if idaapi.get_func(line):
            # The line is inside a function, skip it.
            continue

        # The line is code outside a function. Yield it.
        yield line


for line in iter_handing_lines():
    print "[{:08X}]    {}".format(line, idc.GetDisasm(line))
| improve this answer | |
  • 1
    i dont want to use other lib . is it possible with idapython api itself ? – Vicky Jun 29 '16 at 16:03
  • Updated the answer to match. But @w-s gave a much better answer. I was not aware of that API. – tmr232 Jun 29 '16 at 19:14
  • You can use idautils.Heads(minea,maxea) instead of iter_all_lines, it should give similar functionality – w s Jun 29 '16 at 21:04

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.