Pregunta

I have a piece of assembly code like the following:

mov eax [edi + 24h]

Is there a quick way in IDA Pro to resolve that is a value without having to navigate to the address, figure out what the value is, and add 24h to it? A command line shortcut would be great.

¿Fue útil?

Solución

If you're debugging, the following trick works:

  1. Press Ctrl-R ("User-defined offset")
  2. Enter "edi" in the "Base address" field.
  3. Press Enter

You'll get something like:

mov eax, [edi + (target_address - edi_value)]

This works because during debugging the IDC interpreter recognizes register names and evaluates them. And most numerical input fields in IDA accept IDC expressions.

Licenciado bajo: CC-BY-SA con atribución
No afiliado a StackOverflow
scroll top