3

I am doing Level 2 of TryHackMe's REloaded reverse engineering challenges.

In the screen shot below, you can see I have found the string I want by hovering my mouse over EAX, however a good chunk is missing. How do I see the full string?

I have found that memory location in the stack view and underlined it in red, but I have no idea what to do next.

IDA Free register help

3
  • I think I figured it out. Copy the memory location from the register, then paste it into the long bar at the very bottom of IDA (it has a button called IDC at the far left) and press enter. After, click on the text IDC>WHAT_YOU_PASTED and it takes you to the correct place. Apr 24, 2023 at 11:22
  • 1
    Just click the blue arrow next to the register name.
    – Qwark
    Apr 24, 2023 at 12:35
  • @Qwark Appreciated, also mind checking this follow up question? reverseengineering.stackexchange.com/questions/31820/… Apr 24, 2023 at 17:29

0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Browse other questions tagged or ask your own question.