0

I want to extract a generic signature of a function in IDA and wanted to use just the opcodes of the instructions without its operands.

Example:

enter image description here

From the first instruction I want to know the bytes that tell the disassembler that it is a MOVZX instruction.

From the second and third one the ones that say it is a MOV instruction (probably 8B).

And so on..

I'm aware that some instructions have modifiers. I just want to know the bytes that translate to certain mnemonic.

3

In general this is not solvable since the opcode and operands may be sharing the same bytes (e. g. some instructions encode part of their opcode in the mod R/M byte, which can also contain some of the operands at the same time), but you can get some approximation by inspecting the Operands array of the insn_t structure returned by the decode_insn function. The offb member of each op_t element is supposed to be the offset of the bytes corresponding to the operand in the instruction bytes.

Note that it may be 0 since it’s not always possible to determine operand location at the byte level, especially on non-x86 architectures. For more info check the ua.hpp header in the SDK.

  • Or you could use insn_t::itype – Willem Hengeveld May 13 '18 at 16:33
  • Note also that many risc cpu's store operands as bitfields in the opcode. – Willem Hengeveld May 13 '18 at 16:35

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.