0

IDA Pro noob here. I hit a wrong key while trying it out and now some of the lines that looked like

lea     ecx, [esp+150h+var_13E+2]

now look something like

lea     ecx, [esp+14h]

It computed the sum of the formula to figure out the stack address, removing the stack variable name it was using. It's harder to use now. Is there a way to get back the original line?

3
  • Right Click or press Alt + F1 -> Manual -> Delete everything in the operand text box -> Click OK.
    – 0xec
    Commented Jul 24, 2016 at 16:56
  • Press <kbd>O</kbd> on 14h
    – w s
    Commented Jul 24, 2016 at 17:02
  • Thanks for the suggestions. Unfortunately neither of them work. I had closed and reopened the project so maybe it lost the original information forever? Commented Jul 24, 2016 at 17:49

2 Answers 2

3

You can use K to toggle between stackvar and numerical representations.

0

If none of the solutions already provided work then it could be because the stack variable information itself was lost. You can have IDA regenerate it by undefining your function and redefining it.

To do, so, place your text cursor at the beginning of the function, press U (Undefine), then P (define Procedure).

Note that this will cause IDA to lose any information you manually added to the function (stack variable names, function prototype, etc.), so only do it as a last-resort.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.