2

I am writing an IDA python plugin to identify the operands that are defined and used by every instruction. For now, I am using the canonical feature for an instruction to identify if an operand to the instruction is being used or defined.

While it works for the most part, I'm not sure how to extract information for the following cases

  1. Push/Pop/Retn/Call instructions that modify/use esp
  2. Compare and branching instructions that modify the eflags registers

I could write "if" conditions to handle these cases but I'm wondering if there is a better way to extract information.

Thanks

Improve this question
2
  • For #1 are you just trying to figure out how much it changes the stack pointer by?
    – Avery3R
    Commented Oct 21, 2019 at 19:58
  • I think the only way is if. Personally me have some private IDA plugins for catching execution events (including memory or register modifications),and IDA doesn't have powerful enough command parser for that. IDA has not to have it actually. Capstone will unlikely help much here. if is your friend for this very specific tasks (i. e. detection of command that modifies anything as "side effect" not obvious from operands and opcode).
    – Vitalii
    Commented Oct 25, 2019 at 6:53

1 Answer 1

Reset to default
2

I also had this question. The only solution I've found involves using the Capstone Python bindings in conjunction with IDA. The method call is regs_access https://www.capstone-engine.org/op_access.html

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.