1

I'm trying to determine the destination address for call instructions. I can get this for calls that use an immediate but not for a call to an immediate-assigned register. How can I get the address of the function being called in a situation like this when Ida has inserted a pink comment with funcName?

mov eax, funcName
...
call eax ; funcName
  • How do you get the name where the call is immediate? – NirIzr Oct 12 '18 at 18:45
  • I get the address of the extrn line when the call is immediate by getting the instruction's Operands[1].value – Matthew Oct 12 '18 at 18:51
  • Could you perhaps include a full example as part of your question? – NirIzr Oct 12 '18 at 18:55
1

IDA has a specific mechanism for storing and reading references (either code, data or both) to and from a specific instruction. That mechanism works whenever IDA successfully resolves a reference, which may not always be the case (think of call eax where eax is not easily resolved staticly). You should use that interface for all types of calls.

The function that best suits your use case is probably idautils.CodeRefsFrom which accepts two parameters ea and flow and returns a generator for all code references from given ea. flow is a boolean used to control whether you wish the next instruction included.

There are a bunch of other related functions, such as CodeRefsTo, DataRefsFrom, XrefsTo, etc...

0

Either you use a debugger like OllyDbg and set a breakpoint at the location where the call is. Or you're looking at the previous code at the location where funcName is written. If it is written dynamically, you go best with using a debugger.

  • Since Ida has already analyzed where the registers are set with immediate function addresses, is there a way to get the value without looking at the previous instructions or using a debugger? – Matthew Oct 12 '18 at 15:41
  • How should this work? If the function address is loaded dynamically, for example with loading a library and then the address of an exported function via getProcAddress. IDA Pro can not predict where the function will be located. Or am I missing something? – pudi Oct 12 '18 at 15:53
  • I have call instructions that call an address which Ida has labeled with the function name. The actual call address which I am trying to get just contains extrn funcName – Matthew Oct 12 '18 at 16:56
  • Since IDA has that data available I believe OP just wanted to get it from IDA directly, without extracting the value from the register. The question was specifically for the mov eax, <immediate> / call eax couple lines. – NirIzr Oct 12 '18 at 19:06

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.