문제

I have a piece of assembly code like the following:

mov eax [edi + 24h]

Is there a quick way in IDA Pro to resolve that is a value without having to navigate to the address, figure out what the value is, and add 24h to it? A command line shortcut would be great.

도움이 되었습니까?

해결책

If you're debugging, the following trick works:

  1. Press Ctrl-R ("User-defined offset")
  2. Enter "edi" in the "Base address" field.
  3. Press Enter

You'll get something like:

mov eax, [edi + (target_address - edi_value)]

This works because during debugging the IDC interpreter recognizes register names and evaluates them. And most numerical input fields in IDA accept IDC expressions.

라이센스 : CC-BY-SA ~와 함께 속성
제휴하지 않습니다 StackOverflow
scroll top