4

IDA's default x86 assembly syntax is not very clear about pointer dereferences. One of these is dereferencing the memory operand, and one is simply moving the address to the register:

mov     ecx, offset dword_130B78
mov     eax, off_130AF8

You can improve this slightly by selecting Borland TASM in Ideal Mode in Options > General > Analysis > Target Assembler:

mov     eax, [off_130AF8]

But what I would like is to make it even less ambiguous by always displaying the size qualifier with ptr:

mov     eax, dword ptr [off_130AF8]

Is there a way to force IDA to do this? It does it in some cases but not others, and I'd like it to always do it.

Improve this question
5
  • I'm confused. I never "missed" that at all. Could you elaborate why you need it?! As a reverse engineer you really have to filter through a lot of information and adding this would distract from the important stuff, because the information is right there anyway. You can tell from the target operand what the size of the source must be, so there's no need for dword ptr. Things are different with something like movzx eax, word ptr [eax+esi*2] where the source gets zero-expanded into the target. And then it's not evident whether it's a single or two byte source ...
    – 0xC0000022L ♦
    Commented Nov 8, 2022 at 10:49
  • It’s not actually the size of the register that I care about. What I want is to make it clearer that the pointer is being dereferenced, which as you can see from the first two instruction example can be unclear in IDA’s syntax. It’s really only a problem with x86 (as opposed to RISC machines) because mov can move between both registers and memory.
    – thejoelpatrol
    Commented Nov 11, 2022 at 6:31
  • But that's what the square brackets are for. They tell you something gets dereferenced. If they aren't there, nothing gets dereferenced. And conversely if you imagine dword_130B78 as a C/C++ variable, you can think of offset dword_130B78 as &dword_130B78 ... on the other hand mov eax, [off_130AF8] could be thought of as eax = *off_130AF8 (where off_130AF8 is clearly a 32-bit pointer). I have the issue the other way around, since I rarely read RISC assembly. But once you become accustomed to it, it's no issue.
    – 0xC0000022L ♦
    Commented Nov 11, 2022 at 9:05
  • If you really need this and are a paying customer, make a feature request or ask the Hex-Rays support if they already have this sort of feature and where it is hidden. There is also a forum for paying customers. I have not much hope it's already there, since even scouring ida.cfg and idagui.cfg nothing seemed to match your requirement, but who knows? ;)
    – 0xC0000022L ♦
    Commented Nov 11, 2022 at 9:09
  • As I said from the start, the brackets in the alternate syntax help. It’s at least usable that way. What’s frustrating is that sometimes IDA thinks it should display the size qualifier with some instructions but not others, so it’s just fairly inconsistent. So yes, maybe I will make a feature request.
    – thejoelpatrol
    Commented Nov 12, 2022 at 5:05

1 Answer 1

Reset to default
3

IDA typically displays that size qualifier (byte, word, dword, qword) when the target of the reference is a different size than the operand. This pretty much happens when the size of data referenced by the operand is wrong, but can also happen since multiple instruction may access the memory address differently.

So, (technically) you can force IDA to display the size for each instruction operand by undefining all the data referenced by that operand that you're looking at. This literally undoes all the work that you and IDA did...but hey, why not?

I wrote some IDAPython to do this pretty quickly for the current function. Hopefully you find it effective.

for ea in idautils.FuncItems(ADDRESS):
    for xr in idautils.XrefsFrom(ea):
        if not xr.iscode:
            idaapi.del_items(xr.to)
        continue
    continue

Or better yet, if you want to "fix" your entire database:

for sidx in range(idaapi.get_segm_qty()):
    s = idaapi.getnseg(sidx)
    for ea in idautils.Heads(s.start_ea, s.end_ea):
        if idaapi.get_flags(s.start_ea) & idaapi.MS_CLS == idaapi.FF_DATA:
            idaapi.del_items(ea)
        continue
    continue
Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.