行业解决方案查看所有行业解决方案
IDA 用于解决软件行业的关键问题。
发布时间:2023-04-25 14: 52: 34
Action name: OpUserOffset
This command converts the immediate operand of the current instruction/data to a complex offset expression.
Please click here to learn more about complex offsets.
If a range is selected using the anchor, IDA will perform 'en masse' conversion. It will convert immediate operands of all instructions in the selected range to offsets. However, IDA will ask you first the lower and upper limits of immediate operand value. If the an operand value is >= lower limit and <= upper limit then the operand will be converted to offset, otherwise it will be left unmodified.
If the cursor is on the first operand (the cursor is before ',') then the first operand will be affected; otherwise, all other operands will be affected.
If the offset base is specified as 0xFFFFFFFF, then IDA will create "an automatic offset". Automatic offsets mean that the actual value of the base will be calculated by IDA.
The following offset attributes are available:
Treat the base address as a plain number
if checked, IDA will treat the base address as a number.
In this case, IDA will not create a cross-reference to it
and the base address will be printed as a number,
not as an offset expression.
Offset points past the main object
Offsets of this type point past an object end.
They do not cause an object created/deletion.
Use image base as offset base
These offsets are based on the image base.
There is no need to explicitly specify the offset base.
These offsets are displayed in a concise form:
rva func
instead of
offset func - imagebase
If you intend to reassemble the output file, execute the
following IDC statement:
set_inf_attr(INF_GENFLAGS, get_inf_attr(INF_GENFLAGS) & ~INFFL_ALLASM);
Subtract operand value
Use this option when the operand value should be substracted
from the base to get the target address. In this case the displayed
expression will be displayed as
offset base - target
instead of the usual
offset target - base
Signed operand
Use this option if the operand should be interpreted
as a signed value. This option is only available for OFF_REF8,
OFF_REF16, OFF_REF32 and OFF_REF64 offset types.
Operand value of 0 is invalid
If the operand value is 0, the value will be highlighted in red.
Operand value of NOT 0 is invalid
If the operand value is zero's complement (i.e. all bits are set),
the value will be highlighted in red.
For example a OFF_REF16 with an operand value of 0xFFFF would be invalid.
Use the current address as the offset base
The offset base is dynamically calculated and is equal to the address of
the current element:
- for standalone items: their start address
- for arrays: the start of the array element
- for structures: the start of the structure field
The offset expression is displayed in the following concise form:
offset target - $
where "$" denotes the start of the element (and is assembler-dependent).
To create offsets to structure members use Convert to struct offset command.
See also:
offset by data segment/no
offset by current segment
Edit|Operand types|Offset submenu.
Enter #th operand manually commands.
Set operand type
中文翻译:
操作名称:OpAnyOffset
此命令将当前指令/数据的立即数操作数转换为任意段的偏移量。
IDA将要求为偏移量选择一个基段。
如果使用锚点选择了一个范围,IDA将执行“整体”转换。它将把所
选范围内的所有指令的立即数转换为偏移。然而,IDA将首先询问即时操作数值的下限和上限。如果操作数值为>=下限和<=上限,则操作数将转换为偏移量,否则将保持不变。
如果光标位于第一个操作数上(光标在“,”之前),则第一个操作将受到影响;否则,所有其他操作数都将受到影响。
要创建结构成员的偏移量,请使用“
转换为结构偏移量”命令。另请参阅:按数据段偏移量/不按当前段偏移量编辑|操作数类型|偏移量子菜单。
手动输入第#个操作数命令。设置操作数类型
展开阅读全文
︾
读者也喜欢这些内容:
IDA Pro地址的外部参照图表(Display chart of xrefs to addresses)
...
阅读全文 >
IDA pro为位置命名(Give Name to the Location)
...
阅读全文 >
c语言反编译成汇编的工具有哪些
反汇编即是指将这些执行文件反编译还原成汇编语言或其他语言。市面上的C语言反编译成汇编的工具有很多,本文给大家介绍几款比较优秀的c语言反编译成汇编软件。...
阅读全文 >
怎么用IDA反编译十六进制 IDA反编译十六进制技巧分享
IDA Pro是一个强大的二进制代码分析工具,可以帮助我们分析和逆向工程各种类型的二进制代码。在使用IDA Pro进行逆向分析时,有时我们需要从十六进制代码开始分析。本文将分享如何用IDA反编译十六进制以及一些常用的IDA反编译十六进制技巧。...
阅读全文 >