Learning Malware Analysis

2.3.4 Formatting Operands

At ➋, and ➌ in the preceding listing, the operands (29h and 41h) are represented as hexadecimal constant values, whereas in the source code, we used the decimal value 41 and the character 'A'. IDA gives you the ability to reformat constant values as a decimal, octal, or binary values. If the constant falls within the ASCII printable range, then you can also format the constant value as a character. For example, to change the format of 41h, right-click on the constant value (41h), after which you will be presented with different options, as shown in the following screenshot. Choose the ones that suit your needs: