2

When using Watch List(Debugger->Watches->Add watch) in IDA Pro, I want to add a memory scope(data size(db) , data length(18)) into Watch List.

However, IDA always only add a dword byte(data size(dd) , data length(1)) into Watch List by default, so how can I get Watch List to work as I want?

Improve this question

2 Answers 2

Reset to default
1

Had the same problem, couldn't find the answer anywhere so i found a workaround. I jumped to the address I wanted to watch and used Edit -> Array. Just choose the size of the array you want to watch and then when you add the address to the watch list it adds all the array. Hope it helps.

Improve this answer
1
  • And what if variable is on stack? For me Array is grey when variable is on stack.
    – Vitalii
    Commented Dec 3, 2018 at 9:43
0

This had me confounded for a bit... If this is documented, I'm unsure where. By guessing the following seems to work.

(type)reference

Example: (int[14])0xDEADBEEF

This would give you a representation of an integer array 14 deep at address 0xDEADBEEF independent without having to actually set 0xDEADBEEF to an integer array 14 deep.

This seems to work for structures and such as well: (foo[2])0xBEEF would give you an array of two 'foo' structures starting at 0xBEEF.

This is true as of IDA 7.5.200728 -- I cannot speak to any other version.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.