I'm trying to determine the destination address for call instructions. I can get this for calls that use an immediate but not for a call to an immediate-assigned register. How can I get the address of the function being called in a situation like this when Ida has inserted a pink comment with funcName?

mov eax, funcName
call eax ; funcName
  • How do you get the name where the call is immediate?
    – NirIzr
    Commented Oct 12, 2018 at 18:45
  • I get the address of the extrn line when the call is immediate by getting the instruction's Operands[1].value
    – user25971
    Commented Oct 12, 2018 at 18:51
  • Could you perhaps include a full example as part of your question?
    – NirIzr
    Commented Oct 12, 2018 at 18:55

2 Answers 2


IDA has a specific mechanism for storing and reading references (either code, data or both) to and from a specific instruction. That mechanism works whenever IDA successfully resolves a reference, which may not always be the case (think of call eax where eax is not easily resolved staticly). You should use that interface for all types of calls.

The function that best suits your use case is probably idautils.CodeRefsFrom which accepts two parameters ea and flow and returns a generator for all code references from given ea. flow is a boolean used to control whether you wish the next instruction included.

There are a bunch of other related functions, such as CodeRefsTo, DataRefsFrom, XrefsTo, etc...


Either you use a debugger like OllyDbg and set a breakpoint at the location where the call is. Or you're looking at the previous code at the location where funcName is written. If it is written dynamically, you go best with using a debugger.

  • Since Ida has already analyzed where the registers are set with immediate function addresses, is there a way to get the value without looking at the previous instructions or using a debugger?
    – user25971
    Commented Oct 12, 2018 at 15:41
  • How should this work? If the function address is loaded dynamically, for example with loading a library and then the address of an exported function via getProcAddress. IDA Pro can not predict where the function will be located. Or am I missing something?
    – pudi
    Commented Oct 12, 2018 at 15:53
  • I have call instructions that call an address which Ida has labeled with the function name. The actual call address which I am trying to get just contains extrn funcName
    – user25971
    Commented Oct 12, 2018 at 16:56
  • Since IDA has that data available I believe OP just wanted to get it from IDA directly, without extracting the value from the register. The question was specifically for the mov eax, <immediate> / call eax couple lines.
    – NirIzr
    Commented Oct 12, 2018 at 19:06

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.