行业解决方案查看所有行业解决方案
IDA 用于解决软件行业的关键问题。
发布时间:2023-04-25 17: 12: 58
Action name: OpStackVariable
This command converts immediate operand(s) type of the current instruction to an offset to stack variables, i.e. a local variable or function argument in the stack.
You need to define stack variables before using this command.
If the current operand is based on the value of the stack pointer ([ESP+xxx]) and the SP value is traced incorrectly, then you need to correct SP value using change stack pointer command.
If a range is selected using the anchor, IDA will perform 'en masse' conversion. It will convert immediate operands of all instructions in the selected range to stack variables. However, IDA will ask you first the lower and upper limits of immediate operand value. If the operand value is >= lower limit and <= upper limit then the operand will be converted to stack variable, otherwise it will be left unmodified.
When you use this command, IDA deletes the manually entered operand.
If the cursor is on the first operand (the cursor is before ',') then the first operand will be affected; otherwise all other operands will be affected.
See also:
Edit|Operand types submenu.
Enter #th operand manually commands.
Define stack variables...
中文翻译:
操作名称:OpStackVariable
此命令将当前指令的立即数操作数类型转换为堆栈变量的偏移量,即堆栈中的局部变量或函数参数。在
使用此命令之前,您需要定义堆栈变量。
如果当前操作数基于堆栈指针([ESP+xxx])的值,
并且SP值跟踪不正确,则需要使用change stack pointer命令更正SP值。
如果使用锚点选择范围,IDA将执行“整体”转换。它将把所
选范围内所有指令的立即数转换为堆栈变量。然而,IDA将首先询问即时操作数值的下限和上限。如果操作数值为>=下限和<=上限,则操作数将转换为堆栈变量,否则将保持不变。
使用此命令时,IDA会删除手动输入的操作数。
如果光标位于第一个操作数上(光标在“,”之前),则第一个操作数会受到影响;否则,所有其他操作数都将受到影响。
另请参见:编辑|操作数类型子菜单。
手动输入第#个操作数命令。定义堆栈变量。。。
展开阅读全文
︾