7

Some compilers will add useless bytes in functions or in between functions. In the below block of code at 0040117C we can see the "align" keyword that was inserted by IDA. 

.text:00401176                 mov     eax, [edx+4]
.text:00401179                 call    eax
.text:0040117B
.text:0040117B locret_40117B:                          ; CODE XREF: sub_401160+Dj
.text:0040117B                 retn
.text:0040117B sub_401160      endp
.text:0040117B
.text:0040117B ; ---------------------------------------------------------------------------
.text:0040117C                 align 10h
.text:00401180
.text:00401180 ; =============== S U B R O U T I N E =======================================
.text:00401180
.text:00401180 ; Attributes: bp-based frame
.text:00401180
.text:00401180 ; int __stdcall sub_401180(void *Src)

If we were to view this in hex mode in this example we would see "CC CC ..". With other compilers we might see "90 90 ..". The obvious hint of what this is being used for is the "align" keyword.

Question: how can I tell if a specific byte at an address is marked as align in IDAPython? Example code would be appreciated.

I have found a couple of functions and data types such as FF_ALIGN and idaapi.is_align_insn(ea that looked positive but I have yet to figure out a working example or results that confirm yes or no. I would prefer to rely on IDA types or functions rather than use string parsing for the keyword "align".

Improve this question
5
  • 4
    How about isAlign(idaapi.getFlags(ScreenEA())) ?
    – DCoder
    Jul 5, 2013 at 18:24
  • @DCoder quick note, it works perfect for the first byte of the align but not the second byte or later bytes. Kind of strange. Well at least I know what the first char value is. Cheers.
    – alexanderh
    Jul 5, 2013 at 18:47
  • Look into isHead and prevHead, those functions might help you find the "head" of the align directive (I haven't tested this, it's just a thought).
    – DCoder
    Jul 5, 2013 at 19:23
  • 4
    Should probably post that as an answer so the question isn't permanently marked as being open.
    – Rolf Rolles
    Jul 5, 2013 at 20:55
  • It appears your self-answer covers the solution to the question. You can mark it as accepted by clicking on the check mark next to it.
    – asheeshr
    Jul 7, 2013 at 17:00

2 Answers 2

Reset to default
7

Answering my own question so it's not marked as being opened. @DCoder's comment of using isAlign(idaapi.getFlags(ScreenEA())) is correct. 

.text:0040117B
.text:0040117B locret_40117B:                          ; CODE XREF: sub_401160+Dj
.text:0040117B                 retn
.text:0040117B sub_401160      endp
.text:0040117B
.text:0040117B ; ---------------------------------------------------------------------------
.text:0040117C                 align 10h
.text:00401180
.text:00401180 ; =============== S U B R O U T I N E =======================================
.text:00401180
.text:00401180 ; Attributes: bp-based frame
.text:00401180
.text:00401180 ; int __stdcall sub_401180(void *Src)

If we execute the following command. 

Python>isAlign(idaapi.getFlags(0x0040117C))
True

We would get a value of True. Note: This only works for the first byte that is marked as align. All further align bytes will return false. Thanks DCoder for the answer.

Improve this answer
1

For IDA v7.0 you can use: 

ida_idp.is_align_insn(ScreenEA())
Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.