Reverse Engineering Stack Exchange is a question and answer site for researchers and developers who explore the principles of a system through analysis of its structure, function, and operation. It only takes a minute to sign up.
Sign up to join this community
I'm trying to determine the destination address for call instructions. I can get this for calls that use an immediate but not for a call to an immediate-assigned register. How can I get the address of the function being called in a situation like this when Ida has inserted a pink comment with funcName?
mov eax, funcName
...
call eax ; funcName
IDA has a specific mechanism for storing and reading references (either code, data or both) to and from a specific instruction. That mechanism works whenever IDA successfully resolves a reference, which may not always be the case (think of call eax where eax is not easily resolved staticly). You should use that interface for all types of calls.
The function that best suits your use case is probably idautils.CodeRefsFrom which accepts two parameters ea and flow and returns a generator for all code references from given ea. flow is a boolean used to control whether you wish the next instruction included.
There are a bunch of other related functions, such as CodeRefsTo, DataRefsFrom, XrefsTo, etc...
Either you use a debugger like OllyDbg and set a breakpoint at the location where the call is. Or you're looking at the previous code at the location where funcName is written. If it is written dynamically, you go best with using a debugger.
extrn funcName
mov eax, <immediate> / call eax couple lines.
extrnline when the call is immediate by getting the instruction'sOperands[1].value