6

I'm currently learning IDA Pro, that is set up with the WinDbg debugger. So, say, I triggered a breakpoint and began stepping in and out of functions. I prefer to work in the "Graph view" mode:

IDA debugger view in graph mode

What is the easiest way to see the module name that I'm currently debugging? Or where the EIP or RIP registers points to. In the screenshot above, address of 0x759B86B0.

NirIzr
  • 11,765
  • 1
  • 37
  • 87
c00000fd
  • 1,659
  • 3
  • 25
  • 41

1 Answers1

3
  1. The top right window, the registers window, shows where each register points to and includes the module name of there is one. EIP is not shown in the picture but if you'll scroll down or resize it you'll see it.
  2. The stack shows an address in the same offset as the current EIP points to somewhere in user32, so that's probably it. ebx also points to the same module.
  3. The IDB segment is named correctly, so you can always open the segments view and see which segment contains the current EIP. Additionally, viewing the address (by switching to the Text View or configuring the graph view to show addresses from Options->Graph view) will have the module name before the address.
NirIzr
  • 11,765
  • 1
  • 37
  • 87
  • Also just discovered that if I switch sway from the "Graph view" back to "Text view" (available as a context menu command after a right-click on the "Debug view" window), the assembly code shows module name on the left. Example: USER32:instruction – c00000fd Jan 04 '17 at 09:17
  • 1
    Good point. Edited this in. Also, be aware you can configure IDA to list addresses in graph view as well instead of switching to text view. – NirIzr Jan 04 '17 at 09:26