行业解决方案查看所有行业解决方案
IDA 用于解决软件行业的关键问题。
发布时间:2022-10-15 13: 53: 15
Action name: OpStackVariable
This command converts immediate operand(s) type of the current instruction to an offset to stack variables, i.e. a local variable or function argument in the stack.
You need to define stack variables before using this command.
If the current operand is based on the value of the stack pointer ([ESP+xxx]) and the SP value is traced incorrectly, then you need to correct SP value using change stack pointer command.
If a range is selected using the anchor, IDA will perform 'en masse' conversion. It will convert immediate operands of all instructions in the selected range to stack variables. However, IDA will ask you first the lower and upper limits of immediate operand value. If the operand value is >= lower limit and <= upper limit then the operand will be converted to stack variable, otherwise it will be left unmodified.
When you use this command, IDA deletes the manually entered operand.
If the cursor is on the first operand (the cursor is before ',') then the first operand will be affected; otherwise all other operands will be affected.
中文翻译:
转换操作数为堆栈变量
操作名称:OpStackVariable
此命令将当前指令的立即数操作数转换为堆栈变量的偏移量,即栈中的局部变量或函数参数。
在使用此命令之前,您需要先定义堆栈变量。
如果当前操作数基于堆栈指针的值([ESP+xxx]),并且SP值跟踪不正确,则需要使用更改堆栈指针命令来更正SP值。
如果使用锚点选择了一个范围,IDA将执行“批量”转换。它将把所选范围内所有指令的立即数操作数转换为堆栈变量。但是,IDA会首先询问您立即数值的下限和上限。如果操作数值>=下限且<=上限,则将将操作数转换为堆栈变量,否则将保持不变。
当您使用此命令时,IDA会删除手动输入的操作数。
如果光标位于第一个操作数上(光标在“,”之前),则第一个操作数将受到影响;否则所有其他操作数都将受到影响。
展开阅读全文
︾