1

I working with ARM executable. Sometimes I have something like this MOV instruction:

MOV R0, #0xCD548A40

where the number #0xCD548A40 is a valid offset but IDA doesn't recognize it as such automatically. I tried to reanalyze the executable with enabled option "Automatically convert data to offsets" without of any suitable result. I also tried to write IDAPython script to fix this, but the only possibility of conversion to offset that I found was:

idaapi.jumpto(address)
idaapi.process_ui_action("OpOffset", 0)

Which is not too much convenient to use.

Question

Given an instruction at specific address and one of its operands in a valid offset range is it possible to convert such numbers to offsets using IDA Python ?

Which IDAPython API should I use for it ?

3

I've been using the Ida OpOff function for that. That was idc, not idapython, but https://www.hex-rays.com/products/ida/support/idapython_docs/idc-module.html#OpOff says there's OpOff in idapython as well. In addition, there's another function, OpOffEx, that lets you specify more details. I think one of those is what you need.

2

I happen to just run into this exact issue.

Here's what I did. Replace the for bits with the if bits to just test it on a small bit.

from idautils import *
from idaapi import *
from idc import *

#if True:
#    if True:
#        if True:
#            startea = 0x0F9109DC
#            endea = 0x0F9109F
for segea in Segments():
    for funcea in Functions(segea, SegEnd(segea)):
        functionName = GetFunctionName(funcea)
        for (startea, endea) in Chunks(funcea):
            for ea in Heads(startea, endea):
                if idc.GetMnem(ea) != "MOV" or idc.get_operand_type(ea, 1) != 5 or  idc.get_str_type(idc.get_operand_value(ea, 1)) != 0:
                    continue
                print "0x%08x"%(ea), ":", idc.GetOpnd(ea, 1), idc.get_operand_type(ea, 1)
                idc.op_plain_offset(ea,1,0)

```

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.