1

I want to find 2 consecutive instructions with Ida python

move r2,r3 ; move r2 r4

What is the easy way to find the addresses of that with Ida python?

I can Iterate on all Functions and for each function get dissasembly by idc.GetDisasm and then looking for the value but it's take lot of time.

Is there any smart and faser way?

1

You can use module ida_search and function find_binary. If I understand this correctly, the arguments are

  • search start address
  • search end address
  • search string (like "aa bb cc 01 02")
  • radix(should be 16)
  • direction (like ida_search.SEARCH_DOWN).

First you should find binary representing desired instructions (you can do it by text search in your executable or assemble it for your architecture), then just use it as an argument.

You can find plenty of examples of this function usage for reference at github.

4
  • but how can I convert move r2,r3 to binary code ? Dec 13 '20 at 13:02
  • which CPU/architecture are you working with ?
    – w s
    Dec 13 '20 at 13:17
  • ARM arch . convert it with python Dec 13 '20 at 13:20
  • I don't remember movE instruction in arm architecture (there is mov{condition}, which may be eq, for example, but not E). Did you mean mov ?
    – w s
    Dec 13 '20 at 13:45
1

You can use find_text in the ida_search module if you want to do a textual search. It's probably better to use a more intelligent search method, though. What I personally would do would be to use ida_ua::decode_insn to produce an insn_t object, compare its itype member against the platform-specific constant for the move instruction, and then inspect the register numbers to make sure they match what I want. Something like this:

# Decode instruction at ea
ins = ida_ua.insn_t()
if ida_ua.decode_insn(ins,ea) == 0:
    print("%#x: could not disassemble?" % ea)
    return False

# Check to see if it's the "movl" instruction
if ins.itype != ida_allins.ARM_movl:
    return False

# Is the first operand a register, internal register number 2?
if ins.op[0].type != ida_ua.o_reg:
    return False
# Or whatever the register number for r2 is, might not be 2
if ins.op[0].reg != 2:
    return False

# Is the first operand a register, internal register number 3?
if ins.op[1].type != ida_ua.o_reg:
    return False
# Or whatever the register number for r3 is, might not be 3
if ins.op[1].reg != 3:
    return False

print("%#x: found movl r2, r3" % ea)

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.