I want to search for opcodes in IDA Pro like the following:
How can I do that?
Reverse Engineering Stack Exchange is a question and answer site for researchers and developers who explore the principles of a system through analysis of its structure, function, and operation. It only takes a minute to sign up.Sign up to join this community
It depends on what do you exactly mean by opcode (not in all possible targets it starts with the start of the instruction, and it can be placed weirdly enough in it). Sometimes, however, simple binary searching (Search-->Sequence of bytes, or Alt B) is enough, and if you check "Find all occurrences" in the search dialog IDA will open a window with, correspondingly, all occurrences. You also can try text search with the command mnemonics, such as searching for "
ADD" in the main IDA window in same manner.
If this is not enough, you'll probably need to write IDC or IDAPython script that does one of the following things:
idautils.Heads()IDAPython function) and outputs everything where the command mnemonics fits to what you need (
idautils.Heads()IDAPython function), extracts the opcode from the instruction data (
idc.Byte(address)IDAPython function ) in the mode and order you need and checks if it fits.
ida_search.find_binary I suppose you're going to search for JMP instructions like:
Then ubinstr argument is a string like "FF 25", otherwise if you search for bytes 25 FF - specify "FF25". Space is needed to deal with byte order in the search string.