IDAPython Snippets 🔩

Type of instruction#

Decompile an instruction at a given address ea (below) and print the type of memory if the instruction is a mov.

python
5 lines
1insn = idaapi.insn_t()
2length = idaapi.decode_insn(insn, ea)
3if insn.itype == ida_allins.NN_mov:
4    if insn.Op1.type == ida_ua.o_reg and insn.Op2.type == ida_ua.o_mem:
5	  print(f"{insn.Op1.type} is reg and {insn.Op2.type} is mem")

cdecl function parameters#

Get the value of a function argument that is moved into a register before the function call (for instance for function with the cdecl convention).

In the example below it reads the value of the second argument (register edx) of the function at address 0x1234 and saved its value in a list named arguments.

python
22 lines
 1import idc
 2import idautils
 3
 4resolve_func_addr = 0x1234 # replace by the address of the function
 5
 6arguments = []
 7
 8#+begin_src python
 9for ref in idautils.XrefsTo(resolve_func_addr):
10    for ea in idautils.Heads(ref.frm - 10, ref.frm):
11        insn = idaapi.insn_t()
12        length = idaapi.decode_insn(insn, ea)
13        mnemonic = print_insn_mnem(ea)
14        if mnemonic == "mov":
15            operand_1 = print_operand(ea, 0)
16            fn_hash = idc.get_operand_value(ea, 1)
17            if operand_1 == "edx":
18                print(f"0x{ea:<10x} | {mnemonic} {operand_1} 0x{fn_hash:x}")
19                arguments.append(fn_hash)
20
21for arg in arguments:
22    print(f"0x{arg:x}", end=", ")