5

Some compilers will add useless bytes in functions or in between functions. In the below block of code at 0040117C we can see the "align" keyword that was inserted by IDA.

.text:00401176                 mov     eax, [edx+4]
.text:00401179                 call    eax
.text:0040117B
.text:0040117B locret_40117B:                          ; CODE XREF: sub_401160+Dj
.text:0040117B                 retn
.text:0040117B sub_401160      endp
.text:0040117B
.text:0040117B ; ---------------------------------------------------------------------------
.text:0040117C                 align 10h
.text:00401180
.text:00401180 ; =============== S U B R O U T I N E =======================================
.text:00401180
.text:00401180 ; Attributes: bp-based frame
.text:00401180
.text:00401180 ; int __stdcall sub_401180(void *Src)

If we were to view this in hex mode in this example we would see "CC CC ..". With other compilers we might see "90 90 ..". The obvious hint of what this is being used for is the "align" keyword.

Question: how can I tell if a specific byte at an address is marked as align in IDAPython? Example code would be appreciated.

I have found a couple of functions and data types such as FF_ALIGN and idaapi.is_align_insn(ea that looked positive but I have yet to figure out a working example or results that confirm yes or no. I would prefer to rely on IDA types or functions rather than use string parsing for the keyword "align".

  • 4
    How about isAlign(idaapi.getFlags(ScreenEA())) ? – DCoder Jul 5 '13 at 18:24
  • @DCoder quick note, it works perfect for the first byte of the align but not the second byte or later bytes. Kind of strange. Well at least I know what the first char value is. Cheers. – alexanderh Jul 5 '13 at 18:47
  • Look into isHead and prevHead, those functions might help you find the "head" of the align directive (I haven't tested this, it's just a thought). – DCoder Jul 5 '13 at 19:23
  • 4
    Should probably post that as an answer so the question isn't permanently marked as being open. – Rolf Rolles Jul 5 '13 at 20:55
  • It appears your self-answer covers the solution to the question. You can mark it as accepted by clicking on the check mark next to it. – asheeshr Jul 7 '13 at 17:00
6

Answering my own question so it's not marked as being opened. @DCoder's comment of using isAlign(idaapi.getFlags(ScreenEA())) is correct.

.text:0040117B
.text:0040117B locret_40117B:                          ; CODE XREF: sub_401160+Dj
.text:0040117B                 retn
.text:0040117B sub_401160      endp
.text:0040117B
.text:0040117B ; ---------------------------------------------------------------------------
.text:0040117C                 align 10h
.text:00401180
.text:00401180 ; =============== S U B R O U T I N E =======================================
.text:00401180
.text:00401180 ; Attributes: bp-based frame
.text:00401180
.text:00401180 ; int __stdcall sub_401180(void *Src)

If we execute the following command.

Python>isAlign(idaapi.getFlags(0x0040117C))
True

We would get a value of True. Note: This only works for the first byte that is marked as align. All further align bytes will return false. Thanks DCoder for the answer.

| improve this answer | |
0

For IDA v7.0 you can use:

ida_idp.is_align_insn(ScreenEA())
| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.