Reverse Engineering Stack Exchange is a question and answer site for researchers and developers who explore the principles of a system through analysis of its structure, function, and operation. It only takes a minute to sign up.
Sign up to join this community
I want to extract a generic signature of a function in IDA and wanted to use just the opcodes of the instructions without its operands.
Example:
From the first instruction I want to know the bytes that tell the disassembler that it is a MOVZX instruction.
From the second and third one the ones that say it is a MOV instruction (probably 8B).
And so on..
I'm aware that some instructions have modifiers. I just want to know the bytes that translate to certain mnemonic.
In general this is not solvable since the opcode and operands may be sharing the same bytes (e. g. some instructions encode part of their opcode in the mod R/M byte, which can also contain some of the operands at the same time), but you can get some approximation by inspecting the Operands array of the insn_t structure returned by the decode_insn function. The offb member of each op_t element is supposed to be the offset of the bytes corresponding to the operand in the instruction bytes.
Note that it may be 0 since it’s not always possible to determine operand location at the byte level, especially on non-x86 architectures. For more info check the ua.hpp header in the SDK.
