So, I was trying to load some binary and in the main function, I saw instructions such as
mov edi, [esi+1Ch] ... lea eax, [esi+18h]
So, what are these values at [esi+1Ch] and [esi+18h]. How do you look those with IDA Pro.
Reverse Engineering Stack Exchange is a question and answer site for researchers and developers who explore the principles of a system through analysis of its structure, function, and operation. It only takes a minute to sign up.Sign up to join this community
Seeing that OP is new to RE.SE and by the looks of the question itself I'll assume OP is relatively new to reverse engineering. Apologies if that isn't the case.
Values shown as
[esi+18h] are referencing values currently stored in the listed registers at the time the instruction is executed.
Without letting the executable run and debugging it's execution, stopping at the instructions you're interested investigating it could be extremely difficult to calculate what value will be there. Obviously, previous instructions relating to said registers can make it easier or harder. For example, a specific immidiate value can be assigned to the register just before, making tracing the value back awfully easy.
When that isn't the case, often time placing a breakpoint at that instruction and reading the values in the debugger will be the easy path.
Although IDA's debugger is probably not the best one around, you can definitely get it to breakpoint and read the values. Doing that using IDAPython could be, as another answer notes, by accessing the
cpu object for the register value itself and adding the offset. Then, if the resulting address is actually derefereced, calling
Dword will let you read the value currently in memory. This is the case in the first (but not the second) dereference shown in the two lines of assembly OP asks about (this is because of how the
lea instruction is).