Showing posts with label hex. Show all posts
Showing posts with label hex. Show all posts

Thursday, July 16, 2020

IDAPython beginning, review Hex operand

Just me experimenting with IDAPython
grabbing an operand that is hex and converting/displaying it in multiple ways

# review a hex parameter in assembly
def hexParamReview(addressHex, paramNumber):
 # get line address to pass to idapython
 address = int(addressHex)
 # display what segment its in
 print "segment: %s" % idc.get_segm_name(address)
 # get the assembly command
 print "command: %s" % GetMnem(address)
 # get the assembly 1st parameter
 print "param %d: %s" % (paramNumber, GetOpnd(address, paramNumber))
 # convert parameter from string to hex
 hexAsString = ( GetOpnd(address ,paramNumber)[:-1] )
 print "hex(param 0): 0x%s" % hexAsString
 # convert parameter from hex to int
 try:
  print "int(param 0): %d" % int(hexAsString, 16)
 except(ValueError):
  print "int(param 0): invalid hex"
 # convert parameter from hex to string
 try:
  print "str(param 0): %s" % hexAsString[2:].decode("hex")
 except(TypeError):
  print "str(param 0): undefined"

hexParamReview(0x100048C3, 0)
hexParamReview(here(), 0)


# example:
#  0x100048C3 push 4141h
# output:
#  segment: .text
#  command: push
#  param 0: 4141h
#  hex(param 0): 0x4141
#  int(param 0): 16705
#  str(param 0): AA