1

I want to search for opcodes in IDA Pro like the following:

0xFF25

How can I do that?

  • You're tagging this with IDAPython, so are you specifically looking for a scripted solution? – 0xC0000022L Oct 17 '18 at 19:11
4

It depends on what do you exactly mean by opcode (not in all possible targets it starts with the start of the instruction, and it can be placed weirdly enough in it). Sometimes, however, simple binary searching (Search-->Sequence of bytes, or Alt B) is enough, and if you check "Find all occurrences" in the search dialog IDA will open a window with, correspondingly, all occurrences. You also can try text search with the command mnemonics, such as searching for "ADD" in the main IDA window in same manner.

If this is not enough, you'll probably need to write IDC or IDAPython script that does one of the following things:

  • Passes over all the instructions (for example with idautils.Heads() IDAPython function) and outputs everything where the command mnemonics fits to what you need (idc.print_insn_mnem DAPython function)
  • Passes over all the instructions (for example with idautils.Heads() IDAPython function), extracts the opcode from the instruction data (idc.Byte(address) IDAPython function ) in the mode and order you need and checks if it fits.
0

ida_search.find_binary I suppose you're going to search for JMP instructions like:

jmp     ds:__imp__DebugBreak@0

Then ubinstr argument is a string like "FF 25", otherwise if you search for bytes 25 FF - specify "FF25". Space is needed to deal with byte order in the search string.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.