0

So lets say i have these type of instructions in functions :

x == constant value

x = constant value

x > constant value

no matter if its just an assignment or compare or anything, i want to get the constant values in all functions from main onward

tried googling but couldn't find anything that helps me with this, is this possible?

1

There are probably better answers I'd love to know about but let's say you're looking for instructions that have 0x10 as second operand like:

cmp eax, 10
mov esi, 10

You could do something like:

for func in idautils.Functions():
    flags = idc.get_func_attr(func, FUNCATTR_FLAGS)
    if flags & FUNC_LIB or flags & FUNC_THUNK:
        continue
    dism_addr = list(idautils.FuncItems(func))
    for cur in dism_addr:
        if "10h" in idc.print_operand(cur, 1):
            print "0x%x" % cur, idc.generate_disasm_line(cur, 0)

As IDA disassembles 0x10 as 10h, this would work for any instruction where this constant appears. If you need to check other operands I think it's easy to start from the code above. You could also match the mnemonic (CMP, MOV, etc) using idc.print_insn_mnem(cur) if needed.

Additionally, I've included a check to make sure the code ignores library and thunk functions as you're probably not interested on them. Feel free to remove the check if you want. ;-)

| improve this answer | |
0

You should try to iterate over each instructions and check if the immediate value used by the instruction is equal to that constant you are looking for. In IDApython you may use this function: https://www.hex-rays.com/products/ida/support/idadoc/277.shtml

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.