As shown in the picture below, IDA PRO (6.8)
knows to recognize that al
and eax
are referencing the same register.
Given two operands in IDA Python
(i.e. by idc.GetOpnd(..)
), how can I find that they are referencing the same register?
Reverse Engineering Stack Exchange is a question and answer site for researchers and developers who explore the principles of a system through analysis of its structure, function, and operation. It only takes a minute to sign up.
Sign up to join this communityAs shown in the picture below, IDA PRO (6.8)
knows to recognize that al
and eax
are referencing the same register.
Given two operands in IDA Python
(i.e. by idc.GetOpnd(..)
), how can I find that they are referencing the same register?
Build a dictionary like this:
{ "rax":"rax", "eax":"rax", "ax":"rax" ... }
You can start from the dictionaries contained in https://github.com/angr/archinfo and change it.
EAX
is the full 32-bit value,AL
is the lower 8 bits whereasAH
is the higher 8 bitsEAX
,AH
,AL
are part of the same register, and if there's a IDA Python function that could tell me that? As you can see in the picture, choosingEAX
makeAL
be highlighted too, meaning that there's some king of way that IDA connects between them behind the scenes.