Search code examples
assemblyx86reverse-engineeringida

IDA Pro Dereference Pointer from a Register and a Constant offset

I have a piece of assembly code like the following:

mov eax [edi + 24h]

Is there a quick way in IDA Pro to resolve that is a value without having to navigate to the address, figure out what the value is, and add 24h to it? A command line shortcut would be great.

Solution

  • If you're debugging, the following trick works:

    1. Press Ctrl-R ("User-defined offset")
    2. Enter "edi" in the "Base address" field.
    3. Press Enter

    You'll get something like:

    mov eax, [edi + (target_address - edi_value)]

    This works because during debugging the IDC interpreter recognizes register names and evaluates them. And most numerical input fields in IDA accept IDC expressions.