1

Here is my use case:

I am trying to create a script that finds all instances of a particular instruction (in this case wrmsr) and traces back to find out whether the operands for the instruction are hard-coded literals or variables that are set at runtime. This is meant to help me detect a certain flavor of vulnerable driver.

Does IDAPython have a way to query instruction operands to distinguish between literals and variables? How would I do this?

1

I believe you can look at the type of the operand with something like this (ideally with some more error and type checking):

  insn = idaapi.insn_t()
  idaapi.decode_insn(insn, ea)
  if insn.ops[0].type == ida_ua.o_imm:
      print("This is the constant value ", insn.ops[0])

The possible values for op_t.type are here: IDA SDK: Operand types.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.