Skip to content

Instantly share code, notes, and snippets.

@diamondo25
Created July 30, 2017 16:16
Show Gist options
  • Save diamondo25/36f813a5746e5619445c783a717ee50d to your computer and use it in GitHub Desktop.
Save diamondo25/36f813a5746e5619445c783a717ee50d to your computer and use it in GitHub Desktop.
Get all references to the function, and print the first push opcode of the reference (argument)
#include <idc.idc>
static main (void) {
auto ea = ScreenEA();
auto xt;
auto r = RfirstB(ea);
Message("Function\tCall\tOpcodeAddr\tOpcode\tOpcodeHex\n");
while (r != -1) {
xt = XrefType();
if (xt == fl_CF || xt == fl_CN || xt == fl_F || xt == fl_JF || xt == fl_JN) {
auto funcName = GetFunctionName(r);
if (funcName == "") {
funcName = "undefined";
}
Message("%s\t%08lx\t", funcName, r);
find_out_opcode(r);
}
r = RnextB(ea, r);
}
}
static find_out_opcode(ea) {
auto min_ea = ea - 0x20;
auto found_ea = FindText(ea, SEARCH_NEXT, 0, 0, "push ");
auto opcode = GetOperandValue(found_ea, 0);
Message("%08lx\t%d\t0x%04X", found_ea, opcode, opcode);
if (found_ea < min_ea) {
Message("\tpossibly wrong");
}
Message("\n");
}
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment