TransWikia.com

Extracting instruction and operand information in IDA Python

Reverse Engineering Asked by Ranganatha Rao on September 30, 2021

I am writing an IDA python plugin to identify the operands that are defined and used by every instruction. For now, I am using the canonical feature for an instruction to identify if an operand to the instruction is being used or defined.

While it works for the most part, I’m not sure how to extract information for the following cases

  1. Push/Pop/Retn/Call instructions that modify/use esp
  2. Compare and branching instructions that modify the eflags registers

I could write “if” conditions to handle these cases but I’m wondering if there is a better way to extract information.

Thanks

One Answer

I also had this question. The only solution I've found involves using the Capstone Python bindings in conjunction with IDA. The method call is regs_access https://www.capstone-engine.org/op_access.html

Answered by Trey Keown on September 30, 2021

Add your own answers!

Ask a Question

Get help from others!

© 2024 TransWikia.com. All rights reserved. Sites we Love: PCI Database, UKBizDB, Menu Kuliner, Sharing RPP