Get memory addresses using IDAPython

disassembly ida
Maggie picture Maggie · May 6, 2015 · Viewed 7.1k times · Source

In my code, I am using idc.GetOpnd(ea,0) and idc.GetOpnd(ea,1) to get the 2 operands of an instruction. However, if its a call (or jmp) instruction, I am getting symbols like _perror and loc_8083BA9.

Using IDAPython, is it possible to remove all the symbols and deal only with memory locations.

Answer

nneonneo picture nneonneo · May 6, 2015

Two options:

  1. Use LocByName to resolve names to addresses
  2. Use GetOperandValue instead of GetOpnd to get the value of the operand instead of its display string.

Related questions

IDA - positive sp value has been found error

We have a DLL which we have lost the source for so I am trying to figure out how it works via IDA Dissembler. However there seems to be function that I can't access because I get the following error: …

Read More
Debug executable with arguments in IDA

In the disassembler and debugger IDA, is there any way to run the currently loaded binary with command line parameters? For instance, say I have the command /bin/ls and want to debug it as /bin/ls test.txt, how …

Read More
Is it possible in IDA Pro to make a struct field offset to vtable which is defined in .data segment?

Here is what I want to achieve. I identified a class which I defined as a struct to store class data. One of the methods of the class uses class-field as if it's pointer to vtable. int __thiscall SignOn(struc_4 *…

Read More