Thursday, March 3, 2011

IDAPython script - finding mnemonics

Below is a quick idapython snippet to find specific mnemonics you may want to look for.  either replace " if (mnem == 'fldcw'):" with what you're looking for, or add more to the logic to search for multiple mnemonics.

Disclaimer: a friend and I coded this VERY quickly and there may be errors, its definitely not "production" quality, probably best to use as a reference or something to build upon  ;)


mnemonics = dict()

for seg_ea in Segments():
    for head in Heads(seg_ea, SegEnd(seg_ea)):
        if isCode(GetFlags(head)):
            mnem = GetMnem(head)
            if (mnem == 'fldcw'):
                print 'fldcw at: 0x%x' % head
            mnemonics[mnem] = mnemonics.get(mnem,0)+1

No comments:

Post a Comment