Logo Questions Linux Laravel Mysql Ubuntu Git Menu
 

Disassmbling with IDA python for extract instruction

I am using IDA Python for extract the instructions of a binary. But unfortunately it does not print some instructions completely. For example, BCC, BCS, BEQ are printed as B. Is there any way to correct this problem? Here is my code!!!

for function_ea in idautils.Functions():
    for ins in idautils.FuncItems(function_ea):
        if idaapi.isCode(idaapi.getFlags(ins)):
            print idc.GetMnem(ins)
like image 979
hamid darabian Avatar asked May 20 '26 23:05

hamid darabian


2 Answers

BCC, BCS and BEQ are conditional branch instructions and therefore have same opcode. Everything after the B is the condition code, where:

  • EQ is equal
  • CC is carry clear
  • CS is carry set

See 1 and 2 for more information.

like image 90
crhodes Avatar answered May 23 '26 14:05

crhodes


Try something like that (I checked this on my databases for ARM):

import idautils

for function_ea in idautils.Functions():
    for ins in idautils.FuncItems(function_ea):
        if idaapi.isCode(idaapi.getFlags(ins)):
            cmd = idc.GetDisasm(ins)
            mnem = cmd.split(' ')[0]
            print mnem

From IDA manual:

Get instruction mnemonics

ea - linear address of instruction

returns: 0 - no instruction at the specified location

note: this function may not return exactly the same mnemonics as you see on the screen.

So, if you want to see full mnemonic name you should use external dissasembler/plugin or parse disassembly line.

like image 24
re_things Avatar answered May 23 '26 12:05

re_things



Donate For Us

If you love us? You can donate to us via Paypal or buy me a coffee so we can maintain and grow! Thank you!