To
rename any variable, function, or location, simply click the name you want to change,
and then use the Edit menu, or right-click for a context-sensitive menu to rename the
item to something more meaningful. Virtually every action in IDA has an associated
hotkey combination and it pays to become familiar with the ones you use most frequently.
The manner in which operands are displayed can also be changed via the Edit |
Operand Type menu. Numeric operands can be displayed as hex, decimal, octal, binary,
or character values. Contiguous blocks of data can be organized as arrays to provide
more compact and readable displays (Edit | Array). This is particularly useful when
Figure 12-3 IDA naming and commenting
organizing and analyzing stack frame layouts as shown in Figure 12-4 and Figure 12-5.
The stack frame for any function can be viewed in more detail by double-clicking any
stack variable reference in the function??™s disassembly.
Finally, another useful feature is the ability to define structure templates and apply
those templates to data in the disassembly. Structures are declared in the structures
subview (View | Open Subviews | Structures), and applied using the Edit | Struct Var
menu option. Figure 12-6 shows two structures and their associated data fields.
Pages:
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538