import idaapi import idc class linux_und(idaapi.IDP_Hooks): def __init__(self): idaapi.IDP_Hooks.__init__(self) self.n = idaapi.netnode("$ X86 Linux Undefined Instructions", 0, 1) def ev_ana_insn(self, ins): if idaapi.get_byte(ins.ea) != 0x0f: return False next_byte = idaapi.get_byte(ins.ea + 1) if next_byte == 0xff: name = "ud0" elif next_byte == 0xb9: name = "ud1" elif next_byte == 0x0b: name = "ud2" else: return False ins.itype = idaapi.CUSTOM_CMD_ITYPE + next_byte ins.size = 2 idaapi.set_manual_insn(ins.ea, name) return True class linux_und_t(idaapi.plugin_t): flags = idaapi.PLUGIN_PROC | idaapi.PLUGIN_HIDE comment = "Instruction Decoder" wanted_hotkey = "" help = "Runs transparently" wanted_name = "linux_und" hook = None def init(self): self.hook = None if idaapi.ph_get_id() != idaapi.PLFM_386: return idaapi.PLUGIN_SKIP self.hook = linux_und() self.hook.hook() return idaapi.PLUGIN_KEEP def run(self, arg): pass def term(self): if self.hook: self.hook.unhook() def PLUGIN_ENTRY(): return linux_und_t()