11

This is a very naive question about IDA Pro. Once the IDA debugger started, I would like to be able to type a memory address (or a memory zone) and look easily at the content of it (in various format). With gdb you would do print /x *0x80456ef or, if you want a wider zone, x /6x 0x80456ef.

So, what is the best way to display the memory content from the IDA debugger ?

10

In IDAPython (documentation) you can do something like this to print a byte/word/double word:

Dword(0x80456ef)
Word(0x80456ef)
Byte(0x80456ef)

Or, to print an arbitrary number of bytes:

for b in GetManyBytes(0x40138E, 10):
    print "%X" % ord(b)

If running in the debugger, call it like this:

GetManyBytes(0x40138E, 10, True)
  • Ok, I tried to write Dword(0x80456ef) in the IDC and it worked. Thanks a lot ! But, does someone knows where we can find the complete language usable in the IDC ? Is it matching exactly the idapython language ? Or, is it more ? – perror Apr 23 '13 at 8:31
  • Strangely, the last command that you gave is not working on my IDA Linux because of the "True", you need to write: GetManyBytes(0x804928c, 10, 1) to get it to work. – perror Apr 23 '13 at 8:34
  • There is documentation in IDAs help file if you search for IDC. Also, idapython contains a wrapper around the IDC functions in idc.py. – newgre Apr 23 '13 at 8:34
  • @newgre: I think for completeness the IDC version should be included as well for the one statement where it differs (ignoring semi-colons). +1 – 0xC0000022L Apr 23 '13 at 12:15
  • See idc.idc for full docs. – Igor Skochinsky Apr 23 '13 at 12:57
3

You can also position your cursor in one of the code, hex-view, or stack view windows, and press 'g' to bring up the "jump to address" dialog.

  • and in hexview you can select the format you want to view your hexdump in. – Willem Hengeveld Apr 25 '13 at 8:10
  • I'm a fan of double clicking addresses in the command window. This is an easy way to jump if you use a script to calculate the address. – amccormack Jun 5 '13 at 1:38

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.