📚 OpenRCE is preserved as a read-only archive. Launched at RECon Montreal in 2005. Registration and posting are disabled.








Flag: Tornado! Hurricane!

 Forums >>  IDA Pro  >>  REP prefix

Topic created on: September 30, 2009 12:21 CDT by detlef .

hi,
I want to now if a given instruction uses a rep* prefix.

code sample:
mov exc, 440
rep movsd

Hence, I tried to decode the opcode at a given address _addr with

decode_insn( (ea_t) _addr);

and analyze the global cmd structure.
The problem with this approach is that even though NN_rep is defined in allins.hpp I retrieve NN_movs. According to the definitions of the NN_* a instruction cannot be of type NN_movs and NN_rep.

I thus assumed that NN_rep might be the maintained as the previous insruction.
This assumption proved to be wrong as the decoding of the previous instruction results in cmd.itype = NN_mov; Seriously, I would have been surprised as NN_rep itself is not a instruction but a prefix.

Nevertheless, I currently don't know how to retrieve the information from the SDK.

Does someone of you know how to do it?

Regards,
detlef

  luis   September 30, 2009 15:22.51 CDT
Hi,

This is how I did it for a plugin that looked for inlined memcpy.


if (ua_ana0(addr) == 2)
{
  if ((cmd.auxpref & aux_rep) && (cmd.itype == NN_movs))
  {
    if (cmd.Operands[1].dtyp == dt_dword) // rep movsd

  detlef   October 1, 2009 01:32.45 CDT
thank you for your help!
I was actually looking for the

(cmd.auxpref & aux_rep)

check. I read through the declaration of class insn_t but just didn't get the meaning of the auxpref attribute.
Thanks a lot.

  fileoffset     October 11, 2009 04:49.59 CDT
I love how intuitive IDA's SDK is

Note: Registration is required to post to the forums.

There are 31,328 total registered users.


Recently Created Topics
[help] Unpacking VMP...
Mar/12
Reverse Engineering ...
Jul/06
let 'IDAPython' impo...
Sep/24
set 'IDAPython' as t...
Sep/24
GuessType return une...
Sep/20
About retrieving the...
Sep/07
How to find specific...
Aug/15
How to get data depe...
Jul/07
Identify RVA data in...
May/06
Question about memor...
Dec/12


Recent Forum Posts
Finding the procedur...
rolEYder
Question about debbu...
rolEYder
Identify RVA data in...
sohlow
let 'IDAPython' impo...
sohlow
How to find specific...
hackgreti
Problem with ollydbg
sh3dow
How can I write olly...
sh3dow
New LoadMAP plugin v...
mefisto...
Intel pin in loaded ...
djnemo
OOP_RE tool available?
Bl4ckm4n


Recent Blog Entries
halsten
Mar/14
Breaking IonCUBE VM

oleavr
Oct/24
Anatomy of a code tracer

hasherezade
Sep/24
IAT Patcher - new tool for ...

oleavr
Aug/27
CryptoShark: code tracer ba...

oleavr
Jun/25
Build a debugger in 5 minutes

More ...


Recent Blog Comments
nieo on:
Mar/22
IAT Patcher - new tool for ...

djnemo on:
Nov/17
Kernel debugger vs user mod...

acel on:
Nov/14
Kernel debugger vs user mod...

pedram on:
Dec/21
frida.github.io: scriptable...

capadleman on:
Jun/19
Using NtCreateThreadEx for ...

More ...


Imagery
SoySauce Blueprint
Jun 6, 2008

[+] expand

View Gallery (11) / Submit