0

IDA Pro noob here. I hit a wrong key while trying it out and now some of the lines that looked like

lea     ecx, [esp+150h+var_13E+2]

now look something like

lea     ecx, [esp+14h]

It computed the sum of the formula to figure out the stack address, removing the stack variable name it was using. It's harder to use now. Is there a way to get back the original line?

  • Right Click or press Alt + F1 -> Manual -> Delete everything in the operand text box -> Click OK. – 0xec Jul 24 '16 at 16:56
  • Press <kbd>O</kbd> on 14h – w s Jul 24 '16 at 17:02
  • Thanks for the suggestions. Unfortunately neither of them work. I had closed and reopened the project so maybe it lost the original information forever? – djcouchycouch Jul 24 '16 at 17:49
3

You can use K to toggle between stackvar and numerical representations.

|improve this answer|||||
0

If none of the solutions already provided work then it could be because the stack variable information itself was lost. You can have IDA regenerate it by undefining your function and redefining it.

To do, so, place your text cursor at the beginning of the function, press U (Undefine), then P (define Procedure).

Note that this will cause IDA to lose any information you manually added to the function (stack variable names, function prototype, etc.), so only do it as a last-resort.

|improve this answer|||||

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.