How to get the disassembly line without offset translations in IDAPython?

Question

When I use GetDisasm()to get disassembly line, I find out that it will show some memory references as a variable name.

For example, when raw assembly is:

mov %r15, 0x20b062(%rip)`

GetDisasm()'s output may be:

mov r15d, offset s1

I was hoping there is a way to get the raw instruction, rather than the modified one?

Answer 1

Unfortunately, IDA's disassembly cannot be separated from it's data type information that is inherent to IDA (and is considered one of it's biggest advantages).

You could, however, alter that information manually to get IDA to display the disassembly as you please. For example, you could use the idc.OpHex(ea, n) API function to make an instruction operand to hexadecimal number format.

For example, in order to change the type of the second operand from offset parameter type to hexadecimal parameter type, you can call idc.OpHex with the address of the instruction as the first parameter and the operand number as the second parameter (1 in your example), or -1 for all operands.

For example, given the following instruction in IDA:

.text:00401421                 mov     ebx, offset aL4jDontWait ; "--l4j-dont-wait"

and the output:

Python>idc.GetDisasm(0x0401421)
mov     ebx, offset aL4jDontWait; "--l4j-dont-wait"
Python>idc.OpHex(0x0401421, 1)
True
Python>idc.GetDisasm(0x0401421)
mov     ebx, 407000h

You could then just load a previous save to "undo" all of those changes.