1

I'm starting to work on a plugin to port symbols(stack variable names, operand names, comments, etc) from functions in one database to functions in another database when function names match.

I'm getting familiar with IDA api and now I can't find out how to get a custom name of an operand in IDA Python.

Here's my main function: enter image description here

For now I'd just like to be able to print information I want, I'd like to print operand names: normal names when custom name is not defined, and the custom name when I set the custom name for the operand(Alt+F1 shortcut key by default).

Here's what I came up with for my main function:

import idautils


for functionItem in idautils.FuncItems(0x140012400):
    if ida_bytes.is_code(ida_bytes.get_full_flags(functionItem)):
        instruction = idautils.DecodeInstruction(functionItem)
        print(idc.print_operand(instruction.ip, 0))

And I expect it to print this at the end:

rsp
rdi
rbp:myCustomName

This code prints:

rsp
rdi
rbp

I tried to google but I can't find how to show custom operand name. I could only find these 2 related links:

1

After doing a bunch of searches like operand, manual, manual operand on hex-rays's IDA Python docs website, I finally managed to find the appropriate APIs needed to achieve what I want.

import idautils


for functionItem in idautils.FuncItems(0x140012400):
    if ida_bytes.is_code(ida_bytes.get_full_flags(functionItem)):
        instruction = idautils.DecodeInstruction(functionItem)
        if(ida_bytes.is_forced_operand(instruction.ip, 0)):
            print(ida_bytes.get_forced_operand(instruction.ip, 0))
        else:
            print(idc.print_operand(instruction.ip, 0))

This code above prints the desired result on IDA 7.6 with Python 3.9 installed:

rsp
rdi
rbp:myCustomName

The functions for the manual strings on instructions and operands are:

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.