如何编辑 IDA Pro 函数外部参照?
IDA 非常顽固地错误地标记了我正在执行的函数调用(它是手写的汇编程序,但我已经在调试器中验证了它)。它之前可以工作,但是当我使用 python 将新代码修补到现有数据库时,它似乎有点不稳定。
现在,尽管它承认我正在将 function_a 推送到 eax,但它坚持认为我后续的调用 eax 是对 function_b 的调用。无论我如何尝试“刷新”它,它仍然存在。我尝试删除该函数,取消定义和重新定义该部分,甚至调用 DelCodeXref (最后一个方法似乎将其从函数外部引用列表中删除,但注释仍然出现在调用旁边,如果我取消定义/重新定义,它自然只是再次出现)。
唯一的修复似乎是在其上方的第二个 mov eax, offset function_a 中写入,但仅仅为了消除误导性注释而添加冗余指令并不优雅。有人有什么建议吗?
IDA is very persistent in its mislabeling of a function call I'm making (it's hand-written assembler, but I've verified it in a debugger). It was working before, but as I've been patching in new code to the existing db using python, it seems to have gone a bit wonky.
Now, even though it acknowledges I'm pushing function_a to eax, it insists that my subsequent call eax is a call to function_b. No matter how I try to "refresh" it, it persists. I've tried deleting the function, undefining and redefining the section, even calling DelCodeXref (this last method seems to remove it from the function xrefs list, but the comments still appear next to the call and if i undefine/redefine, it naturally just reappears).
The only fix seems to be writing in a second mov eax, offset function_a above it, but it's hardly elegant to throw in a redundant instruction just to be rid of a misleading comment. Anyone have any suggestions?
如果你对这篇内容有疑问,欢迎到本站社区发帖提问 参与讨论,获取更多帮助,或者扫码二维码加入 Web 技术交流群。

绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱,如果其他用户或者作者回复了您的评论,将不能在第一时间通知您!
发布评论
评论(1)
你用 Alt-F11 尝试过吗? - 运行被调用者插件。
该插件默认安装在ida插件目录中。
did you try this with Alt-F11 ? - that runs the callee plugin.
this plugin is installed in the ida plugins directory by default.