1

I have a four byte global variable that is a pointer to some other data. How can I mark this to be an offset (like pressing o) using IDAPython?

.text:00436FF3      dd 43702Ch

ida_offset.op_offset_ex (ref) seems close to what I want, but is intended for marking instruction operand types, not global variables.

  • 1
    It should work with globals too. Just use operand number 0. – w s Mar 25 '18 at 14:47
  • Thanks, @ws! I've updated the post with an answer below, but I'm afraid this steals your rep. If you repaste the same (or similar content), I'll remove my answer and accept yours. Thanks again! – Willi Ballenthin Mar 25 '18 at 16:04
  • Glad to see you on this SE site. I admire your RCE and forensics related work. – 0xC0000022L May 24 '18 at 18:59
1

Following the advice of @ws, you can use operand number 0 with ida_offset.op_offset(ea, n, type, target=BADADDR, base=0, tdelta=0).

For example:

ida_offset.op_offset(0x436FF3, 0, idc.REF_OFF32)

Note: idc.OpOffset did not work consistently for me, while ida_offset.op_offset did. So, you may want to prefer the later routine.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.