11

This is a very naive question about IDA Pro. Once the IDA debugger started, I would like to be able to type a memory address (or a memory zone) and look easily at the content of it (in various format). With gdb you would do print /x *0x80456ef or, if you want a wider zone, x /6x 0x80456ef.

So, what is the best way to display the memory content from the IDA debugger ?

2 Answers 2

10

In IDAPython (documentation) you can do something like this to print a byte/word/double word:

Dword(0x80456ef)
Word(0x80456ef)
Byte(0x80456ef)

Or, to print an arbitrary number of bytes:

for b in GetManyBytes(0x40138E, 10):
    print "%X" % ord(b)

If running in the debugger, call it like this:

GetManyBytes(0x40138E, 10, True)
6
  • Ok, I tried to write Dword(0x80456ef) in the IDC and it worked. Thanks a lot ! But, does someone knows where we can find the complete language usable in the IDC ? Is it matching exactly the idapython language ? Or, is it more ?
    – perror
    Commented Apr 23, 2013 at 8:31
  • Strangely, the last command that you gave is not working on my IDA Linux because of the "True", you need to write: GetManyBytes(0x804928c, 10, 1) to get it to work.
    – perror
    Commented Apr 23, 2013 at 8:34
  • There is documentation in IDAs help file if you search for IDC. Also, idapython contains a wrapper around the IDC functions in idc.py.
    – newgre
    Commented Apr 23, 2013 at 8:34
  • @newgre: I think for completeness the IDC version should be included as well for the one statement where it differs (ignoring semi-colons). +1
    – 0xC0000022L
    Commented Apr 23, 2013 at 12:15
  • See idc.idc for full docs.
    – Igor Skochinsky
    Commented Apr 23, 2013 at 12:57
3

You can also position your cursor in one of the code, hex-view, or stack view windows, and press 'g' to bring up the "jump to address" dialog.

2
  • and in hexview you can select the format you want to view your hexdump in. Commented Apr 25, 2013 at 8:10
  • I'm a fan of double clicking addresses in the command window. This is an easy way to jump if you use a script to calculate the address.
    – amccormack
    Commented Jun 5, 2013 at 1:38

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.