IDA Python recognize same register

Question

As shown in the picture below, IDA PRO (6.8) knows to recognize that al and eax are referencing the same register.

Given two operands in IDA Python (i.e. by idc.GetOpnd(..)), how can I find that they are referencing the same register?

Not sure what you're asking but AL is part of EAX. EAX is the full 32-bit value, AL is the lower 8 bits whereas AH is the higher 8 bits — Megabeets, Jan 30, 2018 at 19:52
Yes, but my question is how IDA knows to recognize that EAX, AH, AL are part of the same register, and if there's a IDA Python function that could tell me that? As you can see in the picture, choosing EAX make AL be highlighted too, meaning that there's some king of way that IDA connects between them behind the scenes. — macro_controller, Jan 31, 2018 at 8:11

Andrea Fioraldi · Accepted Answer · 2018-01-31 15:27:26Z

0

Build a dictionary like this:

{ "rax":"rax", "eax":"rax", "ax":"rax" ...  }

You can start from the dictionaries contained in https://github.com/angr/archinfo and change it.

answered Jan 31, 2018 at 15:27

Andrea Fioraldi

264 bronze badges

Add a comment |

1 Answer 1