Maybe someone could help me with the following problem:I have an interesting byte sequence that I found within a MIPS ELF binary that exists on the hard drive. This byte sequence may be, for example, 9c 6c 3c 04 80 2d 24 84 85. Now I want to find this byte sequence with IDAPython. Therefore, I use the idc.FindBinary() function like so:address = idc.FindBinary(0, SEARCH_DOWN, byte_sequence)which finds the first occurrence of the byte sequence at address. In general I want to achieve two things:I want to colorize the effected affected lines in the IDA ViewI want to get the disassembled instructionsCurrently there are two subproblems I want to solve:The byte sequence may start within the instruction, for example, in a jal address the byte sequence starts at address instead of at jal. How can I search backwards to find the beginning of the instruction when the byte sequence started within the instruction? Colorizing works with:SetColor(address, CIC_ITEM, 0x208020)If the byte sequence is 9 bytes long (as in the example above), how can I tell IDAPython to disassemble all 9 bytes. I would have to know how long the instructions are that IDAPython disassembles to get to the next instruction. What I know is that I can disassemble at a single addresses with:disasm = idc.GetDisasm(address)Any help would be greatly appreciated!
Colorize and disassemble byte sequences with IDA Pro and IDAPython
ida;disassembly;idapython;binary
You can easily do that using Sark:# Get all the lines relevant to your bytesfor line in sark.lines(start=address, end=address + len(byte_sequence)):    # For each line, color it, and print the disasm and the instruction length    line.color = 0x123456    print 'Line Size: {}\nLine Disasm: {}'.format(line.size, line.disasm)You might need to add handling for cases where there is no disassembly (the bytes are data-bytes and not code).