How to get the disassembly line without offset translations in IDAPython?

Question

When I use GetDisasm()to get disassembly line, I find out that it will show some memory references as a variable name.

For example, when raw assembly is:

mov %r15, 0x20b062(%rip)`

GetDisasm()'s output may be:

mov r15d, offset s1

I was hoping there is a way to get the raw instruction, rather than the modified one?

Answer 1

Unfortunately, IDA's disassembly cannot be separated from it's data type information that is inherent to IDA (and is considered one of it's biggest advantages).

You could, however, alter that information manually to get IDA to display the disassembly as you please. For example, you could use the idc.OpHex(ea, n) API function to make an instruction operand to hexadecimal number format.

For example, in order to change the type of the second operand from offset parameter type to hexadecimal parameter type, you can call idc.OpHex with the address of the instruction as the first parameter and the operand number as the second parameter (1 in your example), or -1 for all operands.

For example, given the following instruction in IDA:

.text:00401421                 mov     ebx, offset aL4jDontWait ; "--l4j-dont-wait"

and the output:

Python>idc.GetDisasm(0x0401421)
mov     ebx, offset aL4jDontWait; "--l4j-dont-wait"
Python>idc.OpHex(0x0401421, 1)
True
Python>idc.GetDisasm(0x0401421)
mov     ebx, 407000h

You could then just load a previous save to "undo" all of those changes.

Answer 2

Using the minsc plugin at https://github.com/arizvisa/ida-minsc, you can do something like the following.

Disclaimer: I maintain the ida-minsc plugin.

The bytes for the given instruction seem to assemble to the following.

0:   4c 89 3d 62 b0 20 00    mov    %r15,0x20b062(%rip)

Bringing it into Python, and writing it at the current address (database.write) results in this instruction.

Python>bytes.fromhex('4c 89 3d 62 b0 20 00').hex()
'4c893d62b02000'

Python>db.write(bytes.fromhex(b))

Python>db.disasm()
'1c009adc8: mov qword ptr cs:unk_1C02A5E31, r15'

If we're okay with changing the operand to hexadecimal, we can use instruction.op_hex. Technically, however, this is a reference and so we should probably use instruction.op_ref. Both of these functions, however, modify the representation of the operand.

Python>ins.op_hex(0)
0x1c02a5e31

Python>ins.op_ref(0)
0x1c02a5e31

If we want to just read the operand (without changing how the disassembler displays it to us), we can use instruction.op. This returns the operand's attributes packed into a tuple.

Python>ins.op(0)
SegmentOffset(segment=%cs, offset=0x1c02a5e31)    

Python>int(ins.op(0))
0x1c02a5e31

We can also translate this tuple to a different base address if necessary.

Python>ins.op(0) - db.baseaddress()
SegmentOffset(segment=%cs, offset=0x2a5e31)

Python>ins.op(0) - db.baseaddress()  + 0x4200000000
SegmentOffset(segment=%cs, offset=0x42002a5e31)