2

How can I search for a sequence of instructions in IDA Pro?

I did manage to search for a single instruction using text search string li.*r4.*-1 (for instruction li r4, -1), but I failed to match multiple instructions or newline character.

It seems to be possible to this by using the binary search, but this requires converting the assembly to the corresponding binary opcodes.

  • You got it the wrong way around, IDA convert binary opcodes to assembly. To the left of the disassembly there should be a list of hex digits that form the opcode and arguments. Perhaps you switched it off. Note that searching for binary bytes may lead to false positives. – usr2564301 May 15 '15 at 15:45
  • Well after finding this blog post I gave it a go, but I failed to force it for a second line. I don't think they created the text search for this purpose. I have a feeling that IDA uses POSIX regex, thus the '?' and similar markers won't work. Also this might be somewhat related. I guess you have to stick to idapython to find multiline instructions. – Dominik Antal May 15 '15 at 17:55
  • @Jongware I know that IDA converts binary opcodes to assembly, what I meant was, that I'd have to convert the assembly instructions I am looking for to opcodes to search for them. – Zulakis May 15 '15 at 18:08
  • Ah - but you would need to find the sequence first so you know what to look for in binary? Try your text search to find each separate opcode. Note down the binary codes, then use these for the combined search. – usr2564301 May 15 '15 at 18:44
4

If you have a fixed set of instructions you are search for eg:

li  r4,0
li  r5,16
li  r6,32

Assuming you already have one location found, you can look in the binary hex view, and find the byte pattern you want and use that in a binary search, just make sure you write each byte with a space between them like 01 02 03 04 so IDA treats them as a sequence of bytes, not as a word/int type search.

If you have a regex like soft match like

slwi r0,r3,2
add r4,r4,r0

but you don't know r4 will be the register used, but know it will be this pattern of slwi and add then I'd write a script (IDC or python) that searches using a text search for outer clause, and then checks for the next instruction to match the expected test, or move to next outer clause.

So the following idc file/code does the outer loop (I was using it to find address offsets that where not set to references), but it might be a good starting base to work from

#include <idc.idc>

static fixAllOffsets( strtext)
{
    auto ea, offset;
    auto last;
    Message("Start\n");
    ea = FindText(0x100000, SEARCH_DOWN | SEARCH_REGEX, 0, 0, strtext);
    last = 0;
    while( ea != BADADDR && ea != last)
    {
        Message("%a\n", ea);

        // INSERT you next line checks here

        last = ea;
        ea = FindText(ea+6, SEARCH_DOWN | SEARCH_REGEX, 0, 0, strtext);
    }
    Message("End\n");
}

static main() 
{
    fixAllOffsets( "0x9[EF][0-9A-F][0-9A-F][0-9A-F][0-9A-F][0-9A-F][0-9A-F]" );
}
|improve this answer|||||

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.