8

I have a DLL with a large number of functions in IDA Pro. I would like to make a script that can scan the instructions within each of the functions looking for a specific instruction. For my specific case right now, I am looking for functions that shift left (shl). I am not sure which register is being shifted so I would like to keep it versatile. I do know that it is only shifting one place in this specific case.

I know python on a very basic level, and I know IDA-Python on a non-existent level. Please help me with suggestions on how to access this data inside IDA.

Edit:
I have read through this question and it says that there is no direct access to the list of functions that have been discovered by IDA. You have to specify a starting function address. Is there any better way to list functions?

Improve this question

2 Answers 2

Reset to default
9

While in the Text View of the disassembly window, press Alt + T. In the Text Search window, search for shl and check Find all occurrences:

Text Search window

Press OK and you will get a list of all functions that contain shl:

Occurrences of: shl

Improve this answer
2
  • 2
    facepalm that didn't occur to me ...
    – 0xea
    Jul 17, 2013 at 14:00
  • So simple, yet it worked perfectly for me. It also allows use of the simple filter ctrl+F to restrict the list by function name prefix. Thanks!
    – WMIF
    Jul 17, 2013 at 23:57
6

Your best bet is to use IDAPython API to do this.

To iterate trough all functions you could do something like 

from idautils import *
from idaapi import *

ea = BeginEA()
for funcea in Functions(SegStart(ea), SegEnd(ea)):
    functionName = GetFunctionName(funcea)
    functionStart = "0x%08x"%funcea
    functionEnd = "0x%08x"%FindFuncEnd(funcea)
    # ...

When you have the start and the end of the function, you can iterate over all effective addresses inbetween and use GetMnem() to get the instruction on that address. Of course, you'd need to handle some specific cases, instruction size and all, but that's the general idea.

Improve this answer
3
  • 1
    There is possibility for function chunks to exists outside of the address range between the start and end addresses, and in fact this is the case in my project. Does IDA account for this when doing the procedure that you are suggesting?
    – WMIF
    Jul 17, 2013 at 23:22
  • yes , i am aware of that, that's why i said you'd need to handle specific cases, just gave a short example on ida python ... really not sure how it would handle the problem you are suggesting
    – 0xea
    Jul 18, 2013 at 18:17
  • You can iterate through all the code in the text segment but there can be errors when data is placed inside the code.
    – Milhous
    Sep 23, 2015 at 18:04

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.