search-for-instructions.py

# Didier Stevens 2017/09/25

def GenerateInstructionList(address_start, address_end):
    instructions = []
    address = address_start
    while address <= end and address != BADADDR:
        instruction = GetMnem(address)
        if instruction != '':
            instructions.append([instruction, address])
        address = NextAddr(address)
    return instructions

def CompareInstructions(segment_instructions, instructions_to_compare):
    while instructions_to_compare != [] and segment_instructions != [] and instructions_to_compare[0] == segment_instructions[0][0]:
        segment_instructions = segment_instructions[1:]
        instructions_to_compare = instructions_to_compare[1:]
    return instructions_to_compare == []

def SearchForInstructions(sequence):
    print('Searching for: %s' % sequence)
    instructions_to_search_for = sequence.split(' ')
    segment_instructions = GenerateInstructionList(SegStart(ScreenEA()), SegEnd(ScreenEA()))
    while segment_instructions != []:
        if CompareInstructions(segment_instructions, instructions_to_search_for):
            print('%s:0x%08x: %s' % (SegName(segment_instructions[0][1]), segment_instructions[0][1], ' | '.join(map(GetDisasm, [i[1] for i in segment_instructions[0:len(instructions_to_search_for)]]))))
        segment_instructions = segment_instructions[1:]

SearchForInstructions('pop pop retn')
SearchForInstructions('call mov mov')