1

I am working on a mipsel binary in IDA Pro and I'm having some issues with renaming subroutines.

I have the subroutine "system" at 0x739644. I renamed this using the N hotkey.

Subroutine renamed as system

Now if I hit X, some of the xrefs have been replaced:

JALR is fine

All of the JALR instructions are fine.

However, sometimes subroutines are called like so:

Alternative call

In this case, sometimes the reference has been renamed and sometimes it hasn't. They all show up in xrefs though:

Some work, some don't

Why is this? Can I rename them all?

  • Try to prefer text format to images... Most of the images that you posted here could be easily replaced by text without harm. Text consume less memory, is more readable and can be copied and pasted. – perror Aug 15 '15 at 10:16
2

Probably it is because IDA treats the la arguments as integers. Try the following : go to one of the places,where system displayed as a number, locate your cursor on this number, press O and recheck if it is still referenced as a number.

Update based on comments - this code illustrates general idea of how it can be fixed automatically. Note: this code is not tested, and provided only for illustrative purposes:

#I didn't check this code, 
#use carefully, 
#beware of errors !

import idc
import idautils
import idaapi


#this function will pass over all assembly commands in correspondiong parameter
#and will set as offsets all operands mentioned in second parameter
#   @param list_of_ranges --> list of tuples of start and end of code ranges where it 
#            should be applied
#   @list_of_commands_and_operands--> list of tuples of assembly commands as string 
#            and number of operands where it should be applied

def multi_convert_op_to_offset(list_of_ranges, list_of_commands_and_operands):
    for (start, end) in list_of_ranges:
        for h in idautils.Heads(start, end):
            dis = idc.GetDisasm(h).split()
            mnemonic = dis[0]
            for mnem, op in list_of_commands_and_operands:
                if mnem == mnemonic:
                    idc.OpOff(h, op, 0)


#Usage:

start = start_of_your_relevant_code
end = end_of_your_relevant_code

l_of_rng = []

l_of_rng.append((start, end))

l_of_cmds_and_ops = []

l_of_cmds_and_ops.append(("la", 1))

multi_convert_op_to_offset(l_of_rng, l_of_cmds_and_ops)
  • Yes - changing it to an offset fixes the issue, but why is it identifying some of them correctly and some not? Is there an automated way of fixing this. – Cybergibbons Aug 15 '15 at 11:30
  • It depends on IDA algorithm of auto-analysis. There is no exact reason why, sometimes it is impossible to distinct exactly between integers and pointers. If you want to automate the solution you'll need to write script in IDAPython which will pass over all relevant la commands and will use hex-rays.com/products/ida/support/idapython_docs/… this function on each of them. – w s Aug 15 '15 at 11:46

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.