1

How do I compare in IDA PRO if constants are located in the same functions or not.. like filter from all constants if I search for 2 constants or more I want to know which function(s) contain all the constants I want to search for, to eliminate searching through all constants with other constants to find matching functions.. (this is how I do it now it's very pain staking)

Constants window looks like this
constantsconstants2
How I do I mark red lines for bad addresses and blue ones for good ones haha
how i do



Is there any script or even better a plugin that does this job easier for me?

Improve this question
2
  • Which IDA version are you using ? Do I understand correctly that you want to find functions which are using similar constants set ? Commented Feb 7, 2016 at 12:00
  • yes I want to find where certain constants have a link together, and best way is if they both in the same function. Commented Feb 8, 2016 at 5:56

1 Answer 1

Reset to default
1

IDAPython is the way to go when you want to do such things. I'd say something like that should work:

CONST_1 = "1234h" CONST_2 = "ABCDh" for func in Functions(): got_first, got_second = False, False func_start = GetFunctionAttr(func,FUNCATTR_START) func_end = GetFunctionAttr(func,FUNCATTR_END) for ea in Heads(func_start, func_end): cur_line = GetDisasm(ea) got_first |= CONST_1 in cur_line got_second |= CONST_2 in cur_line if got_first and got_second: print "Found a match at 0x{:08x}".format(func_start) break

If your binary is really big and it's taking too long, you might think about optimizing the comparaison with operands.

Improve this answer
0

Start asking to get answers

Find the answer to your question by asking.

Ask question

Explore related questions

See similar questions with these tags.