1

In IDAPython, you can obtain the corresponding opcodes for a assembly instruction using the Assemble(ea, line) function.


Here is an example using a PE-file / x86 processor type:

Python>Assemble(FirstSeg(), 'asdf')
Invalid mnemonic -> OK
(False, 'Assembler failed: asdf')

As we can see, the Assemble call returns False and prints a error message for a invalid mnemonic when using an incorrect assembly instruction like asdf.

With a valid assembly instruction, the correct opcode is returned:

Python>Assemble(FirstSeg(), 'ret')
(True, '\xc3')

Here is the same function using a PPC-ELF/ppc processor type:

Python>Assemble(FirstSeg(), 'asdf')
(True, '\x00')

As we can see, no error message is printed and a \x00 is returned as resulting opcode.

The valid sc instruction and any other valid ppc instructions return the same (wrong) value of \x00:

Python>Assemble(FirstSeg(), 'sc')
(True, '\x00')

How can I get IDAPython's Assemble(ea, line) to return the proper opcodes when using a PPC-ELF/ppc processor type?

This is the trace the the function takes:

  1. Assemble(ea, line)
  2. _Assemble(ea, line)
  3. idaapi.AssembleLine(ea, cs, ip, use32, line)

And a usage example of Assemble(), if it wasn't clear: https://code.google.com/p/idapython/source/browse/trunk/Scripts/FindInstructions.py

  • IDA doesn't support assembly for all architectures: "Currently, only the IBM PC processors provide an assembler" (from hex-rays.com/products/ida/support/idadoc/529.shtml, though that is admittedly old). Are you sure PPC supports this? – devttys0 May 19 '15 at 13:13
  • @devttys0 Oh, this may actually be the reason. I just assumed that assembling would just work, as does disassembling. Is there a technical reason why it wouldn't? Isn't it just the reverse of disassembling, which IDA is already doing? The docs you linked say that plugin writers can extend or totally replace the built-in assembler by writing their own. Adding support for PPC this way would probably take alot of effort, wouldn't it? – Zulakis May 19 '15 at 14:33
  • It's up to the developer of the disassembler module to implement an assembler method. Most don't since that's more work and for something that's rarely used. I've written disassembler modules which are a bit of work, but I imagine just overriding the assembler method wouldn't be too much work (disclaimer: I've never done it). – devttys0 May 20 '15 at 7:48
  • That said, if you only need it for IDAPython, wrapping GNU's as (or radare2's rasm2) to and creating an equivalent Assemble function should not be that hard. – tmr232 Dec 17 '15 at 8:53

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.