Exetools

Exetools (https://forum.exetools.com/index.php)
-   Community Tools (https://forum.exetools.com/forumdisplay.php?f=47)
-   -   [idaref] IDA Pro Instruction Reference Plugin (https://forum.exetools.com/showthread.php?t=16412)

sh3dow 01-01-2015 03:36

[idaref] IDA Pro Instruction Reference Plugin
 
IDA Pro Full Instruction Reference Plugin - It's like auto-comments but useful.

I'm generally pretty good at figuring out what various Intel instructions do. But, once in a while I need to either know some precise detail (i.e. exact side effects of SUB) or come across a rare instruction. Then I break my train of thought and have to dig out the reference manual. Which got me thinking: Why can't IDA just give me the full documentation?
https://raw.githubusercontent.com/no...hot/idaref.png
The plugin will monitor the location for your cursor (ScreenEA) and display the full documentation of the instruction. At the moment it only supports x86-64, however adding support for other architectures is relatively easy.

Usage
Simply checkout or download the repository and make sure that the sqlite database file is in the same directory as the 'idaref' python script.
Execute the python script via File->Script File... or ALT+F7. This will open a new view in your IDA workspace. In this view is where the text will be displayed. Now click on the instruction you're curious about and within a second the documentation will populate the view.

Once loaded, the plugin can be turned off by closing the tab window. To control the output right-click on the tab window to get a menu:

*Update View - Load documentation for currectly selected instruction.
*Lookup Instruction - Manual load documentation, you'll be prompted for the instruction.
*Toggle Auto-refresh - Turn on/off auto loading of documentation and rely on the first two options.
https://raw.githubusercontent.com/no...daref_menu.png

https://github.com/nologic/idaref


by nologic

mr.exodia 01-01-2015 08:42

This might be a useful thing to implement in x64dbg too :)

Cheers!

gigaman 01-03-2015 19:03

Yep, this could be useful sometimes.
Doesn't work for VEX-encoded instructions (the database contains a common description for the "old" encoding only - i.e. just for MOVDQA, not for VMOVDQA), but the fix is quite simple (if instruction starts with V and isn't in the database, try to locate it without the prefix).


All times are GMT +8. The time now is 02:14.

Powered by vBulletin® Version 3.8.8
Copyright ©2000 - 2024, vBulletin Solutions, Inc.
Always Your Best Friend: Aaron, JMI, ahmadmansoor, ZeNiX