4

So, I was trying to load some binary and in the main function, I saw instructions such as

mov     edi, [esi+1Ch]
...
lea eax, [esi+18h]

So, what are these values at [esi+1Ch] and [esi+18h]. How do you look those with IDA Pro.

2

One of available options is to simply run Dword(cpu.esi+0x1c) or Dword(cpu.esi+0x18) correspondingly in idapython console.

1

Seeing that OP is new to RE.SE and by the looks of the question itself I'll assume OP is relatively new to reverse engineering. Apologies if that isn't the case.

Values shown as [esi+1Ch] or [esi+18h] are referencing values currently stored in the listed registers at the time the instruction is executed.

Without letting the executable run and debugging it's execution, stopping at the instructions you're interested investigating it could be extremely difficult to calculate what value will be there. Obviously, previous instructions relating to said registers can make it easier or harder. For example, a specific immidiate value can be assigned to the register just before, making tracing the value back awfully easy.

When that isn't the case, often time placing a breakpoint at that instruction and reading the values in the debugger will be the easy path.

Although IDA's debugger is probably not the best one around, you can definitely get it to breakpoint and read the values. Doing that using IDAPython could be, as another answer notes, by accessing the cpu object for the register value itself and adding the offset. Then, if the resulting address is actually derefereced, calling Dword will let you read the value currently in memory. This is the case in the first (but not the second) dereference shown in the two lines of assembly OP asks about (this is because of how the lea instruction is).

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.