0

As shown in the picture below, IDA PRO (6.8) knows to recognize that al and eax are referencing the same register.

enter image description here

Given two operands in IDA Python (i.e. by idc.GetOpnd(..)), how can I find that they are referencing the same register?

  • Not sure what you're asking but AL is part of EAX. EAX is the full 32-bit value, AL is the lower 8 bits whereas AH is the higher 8 bits – Megabeets Jan 30 '18 at 19:52
  • Yes, but my question is how IDA knows to recognize that EAX, AH, AL are part of the same register, and if there's a IDA Python function that could tell me that? As you can see in the picture, choosing EAX make AL be highlighted too, meaning that there's some king of way that IDA connects between them behind the scenes. – macro_controller Jan 31 '18 at 8:11
0

Build a dictionary like this:

{ "rax":"rax", "eax":"rax", "ax":"rax" ...  }

You can start from the dictionaries contained in https://github.com/angr/archinfo and change it.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.