How do you look for a a particular value at address in IDA

Question

So, I was trying to load some binary and in the main function, I saw instructions such as

mov     edi, [esi+1Ch]
...
lea eax, [esi+18h]

So, what are these values at [esi+1Ch] and [esi+18h]. How do you look those with IDA Pro.

Answer 1

One of available options is to simply run Dword(cpu.esi+0x1c) or Dword(cpu.esi+0x18) correspondingly in idapython console.

latest API is: ida_bytes.get_dword

Answer 2

Seeing that OP is new to RE.SE and by the looks of the question itself I'll assume OP is relatively new to reverse engineering. Apologies if that isn't the case.

Values shown as [esi+1Ch] or [esi+18h] are referencing values currently stored in the listed registers at the time the instruction is executed.

Without letting the executable run and debugging it's execution, stopping at the instructions you're interested investigating it could be extremely difficult to calculate what value will be there. Obviously, previous instructions relating to said registers can make it easier or harder. For example, a specific immidiate value can be assigned to the register just before, making tracing the value back awfully easy.

When that isn't the case, often time placing a breakpoint at that instruction and reading the values in the debugger will be the easy path.

Although IDA's debugger is probably not the best one around, you can definitely get it to breakpoint and read the values. Doing that using IDAPython could be, as another answer notes, by accessing the cpu object for the register value itself and adding the offset. Then, if the resulting address is actually derefereced, calling Dword will let you read the value currently in memory. This is the case in the first (but not the second) dereference shown in the two lines of assembly OP asks about (this is because of how the lea instruction is).