If IDA suspects that an operand can be represented as something different
from a plain number, it will mark the operand as "suspicious" and display
it in red/orange.
Index
| Previous topic
| Next topic
Two values control the definition of suspiciousness. An operand is 'suspicious' if it has an immediate value between low and high 'suspicious' limits. The comparison is always unsigned, i.e. in the instruction
mov ax,[bp-2]
the immediate operand is 0xFFFE, not -2.IDA uses a simple heuristic to determine initial suspiciousness limits. You may change these limits any time you want.
See also
Comments Dialog How to Enter a Number.