Exetools  

Go Back   Exetools > General > Community Tools

Notices

Reply
 
Thread Tools Display Modes
  #1  
Old 01-01-2015, 03:36
sh3dow sh3dow is offline
Family
 
Join Date: Oct 2014
Posts: 158
Rept. Given: 113
Rept. Rcvd 79 Times in 24 Posts
Thanks Given: 458
Thanks Rcvd at 202 Times in 75 Posts
sh3dow Reputation: 79
[idaref] IDA Pro Instruction Reference Plugin

IDA Pro Full Instruction Reference Plugin - It's like auto-comments but useful.

I'm generally pretty good at figuring out what various Intel instructions do. But, once in a while I need to either know some precise detail (i.e. exact side effects of SUB) or come across a rare instruction. Then I break my train of thought and have to dig out the reference manual. Which got me thinking: Why can't IDA just give me the full documentation?
https://raw.githubusercontent.com/no...hot/idaref.png
The plugin will monitor the location for your cursor (ScreenEA) and display the full documentation of the instruction. At the moment it only supports x86-64, however adding support for other architectures is relatively easy.

Usage
Simply checkout or download the repository and make sure that the sqlite database file is in the same directory as the 'idaref' python script.
Execute the python script via File->Script File... or ALT+F7. This will open a new view in your IDA workspace. In this view is where the text will be displayed. Now click on the instruction you're curious about and within a second the documentation will populate the view.

Once loaded, the plugin can be turned off by closing the tab window. To control the output right-click on the tab window to get a menu:

*Update View - Load documentation for currectly selected instruction.
*Lookup Instruction - Manual load documentation, you'll be prompted for the instruction.
*Toggle Auto-refresh - Turn on/off auto loading of documentation and rely on the first two options.
https://raw.githubusercontent.com/no...daref_menu.png

https://github.com/nologic/idaref


by nologic
Reply With Quote
The Following 7 Users Gave Reputation+1 to sh3dow For This Useful Post:
alephz (01-01-2015), computerline (01-01-2015), emo (01-01-2015), Git (01-03-2015), MarcElBichon (01-01-2015), TechLord (01-13-2015), TQN (01-02-2015)
The Following 2 Users Say Thank You to sh3dow For This Useful Post:
sendersu (04-12-2015), zeytunak (04-12-2015)
  #2  
Old 01-01-2015, 08:42
mr.exodia mr.exodia is offline
Retired Moderator
 
Join Date: Nov 2011
Posts: 784
Rept. Given: 492
Rept. Rcvd 1,122 Times in 305 Posts
Thanks Given: 90
Thanks Rcvd at 711 Times in 333 Posts
mr.exodia Reputation: 1100-1299 mr.exodia Reputation: 1100-1299 mr.exodia Reputation: 1100-1299 mr.exodia Reputation: 1100-1299 mr.exodia Reputation: 1100-1299 mr.exodia Reputation: 1100-1299 mr.exodia Reputation: 1100-1299 mr.exodia Reputation: 1100-1299 mr.exodia Reputation: 1100-1299
This might be a useful thing to implement in x64dbg too

Cheers!
Reply With Quote
The Following User Gave Reputation+1 to mr.exodia For This Useful Post:
sh3dow (01-02-2015)
  #3  
Old 01-03-2015, 19:03
gigaman gigaman is offline
Friend
 
Join Date: Jun 2002
Posts: 87
Rept. Given: 0
Rept. Rcvd 3 Times in 2 Posts
Thanks Given: 0
Thanks Rcvd at 14 Times in 11 Posts
gigaman Reputation: 4
Yep, this could be useful sometimes.
Doesn't work for VEX-encoded instructions (the database contains a common description for the "old" encoding only - i.e. just for MOVDQA, not for VMOVDQA), but the fix is quite simple (if instruction starts with V and isn't in the database, try to locate it without the prefix).
Reply With Quote
Reply

Tags
ida pro, ida pro plugin, reference

Thread Tools
Display Modes

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off


Similar Threads
Thread Thread Starter Forum Replies Last Post
Hex-rays PPC decompiler and bctr instruction jonwil General Discussion 0 04-10-2021 20:17
Instruction Size visu General Discussion 9 05-16-2005 18:23
Strange Instruction CTS BE thomasantony General Discussion 2 03-23-2005 04:41


All times are GMT +8. The time now is 17:10.


Always Your Best Friend: Aaron, JMI, ahmadmansoor, ZeNiX, chessgod101
( 1998 - 2024 )