When I select an assembly instruction in IDA graph view, I want to see the exact bytes corresponding to the selected instruction when I switch to He view in IDA. How do I do that?
3
-
1You do not need the hex viewer for that. Under (from memory) View options, you can check a box to get the source bytes in a column next to the actual disassembled instructions.– JongwareCommented Jan 16, 2017 at 18:21
-
I can't spot nothing of that sort– sherlockCommented Jan 16, 2017 at 18:31
-
1Foind it: hex-rays.com/products/ida/support/idadoc/605.shtml– JongwareCommented Jan 16, 2017 at 18:37
Add a comment
|
2 Answers
The easiest way to get this done is simply by opening the Options -> General -> Disassembly window, and setting the "Number of opcode bytes (Graph)" field to the number of opcode bytes you wish IDA to show you in the both the graph and linear disassembly listing views.
This is how the configuration change should look:
And the result of doing that will be similar to what's seen in the following image:
Note that at most 6 bytes are displayed, and a plus sign is used to indicate a specific opcode contains additional bytes.
IDA actually already does that for you. Put your mouse cursor on the instruction that you are interested in, go to Hex View, and the bytes corresponding to that instruction will be highlighted.
If you want to see the bytes corresponding to multiple instructions, you can write an IDAPython script to do that, such as this: (first use your cursor to select the instructions, then run this script)
start = idc.SelStart()
end = idc.SelEnd()
print hex(start), hex(end)
while start < end:
print hex(idc.Byte(start))
start = idc.NextAddr(start)
