1

I'm writing an IDA python script, and i need to be able to detect position independent code. I have an instruction that IDA displays using the operand name 'format'

lea     rdi, format

However, when i use capstone disassembler or disassember.io it displays the instruction as

lea     rdi, [rip + 0xd5a]

Is there an ida python function that will return the instruction in the form of the register + the immediate offset instead of the relative value or operand name?

I tried using idc.get_operand_value but it returns the full address, not the register + offset.

I've also tried idc.GetDisasm but that just returns the instruction as it's displayed in IDA.

The hexbytes for the instruction are 48 8d 3d 5a 0d 00 00

Architecture is i386 x86-64

1

Options-General-Analysis-Processor specific options, [x] Explicit RIP-addressing.

| improve this answer | |
  • That's perfect, thanks! – Brightflame Jun 10 at 16:04

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.