PDA

View Full Version : Finding instructions


Hex Blog
September 24th, 2009, 15:20
Searching for instructions and opcodes is a basic necessity for security researchers, therefore to address this issue IDA Pro provides many search facilities, among them we list:

Text search: Used to search the listing for text patterns (regular expressions are allowed). One can write a regular expression to find any assignment to the eax register (with the mov instruction)
http://hexblog.com/ida_pro/pix/findinst_text.jpg
Binary search: Allows you to search for binary patterns with wildcard support. It is also possible to search for strings alongside with the binary patterns.
http://hexblog.com/ida_pro/pix/findinst_bin.jpg
Immediate search: Very useful to find constants and magic numbers used in the program.Please refer to the search menu for other search facilities
None of the existing search facilities allow us to readily search for instructions and opcodes. In order to do that, one has to assemble the instruction in question then use the Binary Search to find the pattern.

Each processor module in IDA can implement the assemble notification callback:
Code:
assemble, // Assemble an instruction
// (display a warning if an error is found)
// args:
// ea_t ea - linear address of instruction
// ea_t cs - cs of instruction
// ea_t ip - ip of instruction
// bool use32 - is 32bit segment?
// const char *line - line to assemble
// uchar *bin - pointer to output opcode buffer
// returns size of the instruction in bytes
Once this callback is implemented by the processor module one can then assemble instructions by calling the ph.notify() with the assemble notification code (please check this forum discussion here ("http://hex-rays.com/forum/viewtopic.php?f=8&t=2103&p=8834&hilit=assemble#p8834")).
Currently, only the pc processor module implements this callback and provides a very basic assembler.
We wrote a script that allows you to search for opcodes and assembly statements, so for example to find the "33 c0" (xor eax, eax), followed by "pop ebp" and followed by "ret" we could search like this:
Code:
find("33 c0;pop ebp;ret"

That's the script operation in brief:

Do some input initial validation
Split the patterns
Loop:

Determine if the pattern is an assembly instruction or opcode list (using a simple regular expression)
If pattern is an instruction then assemble it
Accumulate the assembled (or converted opcodes) into a single buffer

Now that we have one single binary buffer we can search for it with FindBinary()Display the result
http://hexblog.com/ida_pro/pix/findinst_demo.jpg
The script ("http://hexblog.com/ida_pro/files/FindInstructions.py") uses the Assemble() function (available in IdaPython r233 ("http://code.google.com/p/idapython") and above). Comments and suggestions are welcome.



http://hexblog.com/2009/09/assembling_and_finding_instruc.html