I have a piece of assembly code like the following:

mov eax [edi + 24h]

Is there a quick way in IDA Pro to resolve that is a value without having to navigate to the address, figure out what the value is, and add 24h to it? A command line shortcut would be great.

有帮助吗?

解决方案

If you're debugging, the following trick works:

  1. Press Ctrl-R ("User-defined offset")
  2. Enter "edi" in the "Base address" field.
  3. Press Enter

You'll get something like:

mov eax, [edi + (target_address - edi_value)]

This works because during debugging the IDC interpreter recognizes register names and evaluates them. And most numerical input fields in IDA accept IDC expressions.

许可以下: CC-BY-SA归因
不隶属于 StackOverflow
scroll top