1

I am working on a mipsel binary in IDA Pro and I'm having some issues with renaming subroutines.

I have the subroutine "system" at 0x739644. I renamed this using the N hotkey.

Subroutine renamed as system

Now if I hit X, some of the xrefs have been replaced:

JALR is fine

All of the JALR instructions are fine.

However, sometimes subroutines are called like so:

Alternative call

In this case, sometimes the reference has been renamed and sometimes it hasn't. They all show up in xrefs though:

Some work, some don't

Why is this? Can I rename them all?

Improve this question
1
  • Try to prefer text format to images... Most of the images that you posted here could be easily replaced by text without harm. Text consume less memory, is more readable and can be copied and pasted.
    – perror
    Commented Aug 15, 2015 at 10:16

1 Answer 1

Reset to default
2

Probably it is because IDA treats the la arguments as integers. Try the following : go to one of the places,where system displayed as a number, locate your cursor on this number, press O and recheck if it is still referenced as a number.

Update based on comments - this code illustrates general idea of how it can be fixed automatically. Note: this code is not tested, and provided only for illustrative purposes:

#I didn't check this code, 
#use carefully, 
#beware of errors !

import idc
import idautils
import idaapi


#this function will pass over all assembly commands in correspondiong parameter
#and will set as offsets all operands mentioned in second parameter
#   @param list_of_ranges --> list of tuples of start and end of code ranges where it 
#            should be applied
#   @list_of_commands_and_operands--> list of tuples of assembly commands as string 
#            and number of operands where it should be applied

def multi_convert_op_to_offset(list_of_ranges, list_of_commands_and_operands):
    for (start, end) in list_of_ranges:
        for h in idautils.Heads(start, end):
            dis = idc.GetDisasm(h).split()
            mnemonic = dis[0]
            for mnem, op in list_of_commands_and_operands:
                if mnem == mnemonic:
                    idc.OpOff(h, op, 0)


#Usage:

start = start_of_your_relevant_code
end = end_of_your_relevant_code

l_of_rng = []

l_of_rng.append((start, end))

l_of_cmds_and_ops = []

l_of_cmds_and_ops.append(("la", 1))

multi_convert_op_to_offset(l_of_rng, l_of_cmds_and_ops)
Improve this answer
2
  • Yes - changing it to an offset fixes the issue, but why is it identifying some of them correctly and some not? Is there an automated way of fixing this.
    – Cybergibbons
    Commented Aug 15, 2015 at 11:30
  • It depends on IDA algorithm of auto-analysis. There is no exact reason why, sometimes it is impossible to distinct exactly between integers and pointers. If you want to automate the solution you'll need to write script in IDAPython which will pass over all relevant la commands and will use hex-rays.com/products/ida/support/idapython_docs/… this function on each of them.
    – w s
    Commented Aug 15, 2015 at 11:46

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.