Is there any way to write a IDA script that finds constant values used in all functions, no matter the instruction?

Question

So lets say i have these type of instructions in functions :

x == constant value

x = constant value

x > constant value

no matter if its just an assignment or compare or anything, i want to get the constant values in all functions from main onward

tried googling but couldn't find anything that helps me with this, is this possible?

Answer 1

There are probably better answers I'd love to know about but let's say you're looking for instructions that have 0x10 as second operand like:

cmp eax, 10
mov esi, 10

You could do something like:

for func in idautils.Functions():
    flags = idc.get_func_attr(func, FUNCATTR_FLAGS)
    if flags & FUNC_LIB or flags & FUNC_THUNK:
        continue
    dism_addr = list(idautils.FuncItems(func))
    for cur in dism_addr:
        if "10h" in idc.print_operand(cur, 1):
            print "0x%x" % cur, idc.generate_disasm_line(cur, 0)

As IDA disassembles 0x10 as 10h, this would work for any instruction where this constant appears. If you need to check other operands I think it's easy to start from the code above. You could also match the mnemonic (CMP, MOV, etc) using idc.print_insn_mnem(cur) if needed.

Additionally, I've included a check to make sure the code ignores library and thunk functions as you're probably not interested on them. Feel free to remove the check if you want. ;-)

Answer 2

You should try to iterate over each instructions and check if the immediate value used by the instruction is equal to that constant you are looking for. In IDApython you may use this function: https://www.hex-rays.com/products/ida/support/idadoc/277.shtml