2

I am looking to disassemble an instruction at an address. I know that there are many instructions that can accomplish this such as idc.GetDisasm(), idc.GetDisasmEx(), idaapi.generate_disassembly(), etc.

When I disassemble a line that has a variable in it, the variable appears in the disassembly. ie 38 81 00 38 disassembles as addi r4, r1, 0x80+var_48 instead of addi r4, r1, 0x38.

Is there any way to disassemble this in the latter form ?

1

You'll have to set the operand type, there are various functions to accomplish that. OpHex is most likely what you want to use.

  • Thanks for the feedback. This could work if it is called for each instruction. However, two problems arise with it. A) I would like to restore it to the way it was prior to converting it with OpHex. B) OpHex/OpOff etc.. does not convert the operand of a branch. – Bambu Oct 13 '14 at 2:36
1

not idapython but idc

auto i;

for (  i = MinEA() ; i < MaxEA() ; i = NextHead(i, MaxEA()) )
{
    OpHex(i,-1);
}

take a look here for bit more details

Convert [arg8+foo-blah+28] to [ebp+38]

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.