8

When I select an assembly instruction in IDA graph view, I want to see the exact bytes corresponding to the selected instruction when I switch to He view in IDA. How do I do that?

11

The easiest way to get this done is simply by opening the Options -> General -> Disassembly window, and setting the "Number of opcode bytes (Graph)" field to the number of opcode bytes you wish IDA to show you in the both the graph and linear disassembly listing views.

This is how the configuration change should look:

enter image description here

And the result of doing that will be similar to what's seen in the following image:

enter image description here

Note that at most 6 bytes are displayed, and a plus sign is used to indicate a specific opcode contains additional bytes.

4

IDA actually already does that for you. Put your mouse cursor on the instruction that you are interested in, go to Hex View, and the bytes corresponding to that instruction will be highlighted.

If you want to see the bytes corresponding to multiple instructions, you can write an IDAPython script to do that, such as this: (first use your cursor to select the instructions, then run this script)

start = idc.SelStart()
end = idc.SelEnd()

print hex(start), hex(end)

while start < end: 
    print hex(idc.Byte(start))
    start = idc.NextAddr(start)

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.