行业解决方案查看所有行业解决方案
IDA 用于解决软件行业的关键问题。
发布时间:2023-04-21 14: 00: 28
Action name:ChangeStackPointer
This command allows you to specify how the stack pointer(SP)is modified by the current instruction.
You cannot use this command if the current instruction does not belong to any function.
You will need to use this command only if IDA was not able to trace the value of the SP register.Usually IDA can handle it but in some special cases it fails.An example of such a situation is an indirect call of a function that purges its parameters from the stack.In this case,IDA has no information about the function and cannot properly trace the value of SP.
Please note that you need to specify the difference between the old and new values of SP.
The value of SP is used if the current function accesses local variables by[ESP+xxx]notation.
以下为中文翻译
操作名称:ChangeStackPointer
此命令允许您指定当前指令如何修改堆栈指针(SP)。如果
当前指令不属于任何函数,则不能使用此命令。
只有当IDA无法跟踪SP寄存器的值时,才需要使用此命令。通常IDA可以处理,但在某些特殊情况下失败。这种情况的一个例子是间接调用从堆栈中清除其参数的函数。在这种情况下,IDA没有关于函数的信息,无法正确跟踪SP的值。
请注意,您需要指定SP的旧值和新值之间的差异。
如果当前函数通过[ESP+xxx]表示法访问局部变量,则使用SP的值,
展开阅读全文
︾