8

I have a DLL with a large number of functions in IDA Pro. I would like to make a script that can scan the instructions within each of the functions looking for a specific instruction. For my specific case right now, I am looking for functions that shift left (shl). I am not sure which register is being shifted so I would like to keep it versatile. I do know that it is only shifting one place in this specific case.

I know python on a very basic level, and I know IDA-Python on a non-existent level. Please help me with suggestions on how to access this data inside IDA.

Edit:
I have read through this question and it says that there is no direct access to the list of functions that have been discovered by IDA. You have to specify a starting function address. Is there any better way to list functions?

8

While in the Text View of the disassembly window, press Alt + T. In the Text Search window, search for shl and check Find all occurrences:

Text Search window

Press OK and you will get a list of all functions that contain shl:

Occurrences of: shl

  • 2
    facepalm that didn't occur to me ... – 0xea Jul 17 '13 at 14:00
  • So simple, yet it worked perfectly for me. It also allows use of the simple filter ctrl+F to restrict the list by function name prefix. Thanks! – WMIF Jul 17 '13 at 23:57
6

Your best bet is to use IDAPython API to do this.

To iterate trough all functions you could do something like

from idautils import *
from idaapi import *

ea = BeginEA()
for funcea in Functions(SegStart(ea), SegEnd(ea)):
    functionName = GetFunctionName(funcea)
    functionStart = "0x%08x"%funcea
    functionEnd = "0x%08x"%FindFuncEnd(funcea)
    # ...

When you have the start and the end of the function, you can iterate over all effective addresses inbetween and use GetMnem() to get the instruction on that address. Of course, you'd need to handle some specific cases, instruction size and all, but that's the general idea.

  • 1
    There is possibility for function chunks to exists outside of the address range between the start and end addresses, and in fact this is the case in my project. Does IDA account for this when doing the procedure that you are suggesting? – WMIF Jul 17 '13 at 23:22
  • yes , i am aware of that, that's why i said you'd need to handle specific cases, just gave a short example on ida python ... really not sure how it would handle the problem you are suggesting – 0xea Jul 18 '13 at 18:17
  • You can iterate through all the code in the text segment but there can be errors when data is placed inside the code. – Milhous Sep 23 '15 at 18:04

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.