1

I have a little problem, i have loaded some firmware to IDA and it didn't analyze it correctly so i did located and tagged all the strings manyaly but it didn't helped me to find the references to them in the code. How can i search for references to some memory locations (strings) in IDA ?

closed as too broad by Jason Geffner, jvoisin, perror, peter ferrie, Guntram Blohm Apr 26 '16 at 17:24

Please edit the question to limit it to a specific problem with enough detail to identify an adequate answer. Avoid asking multiple distinct questions at once. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.

2

This is a long shot, but i assume what happened is something like this:

Your firmware does not have any ELF or similar headers (this isn't really a problem, it's expected to be this way), but is supposed to be loaded at a specific location in memory, which is not 0. Or, maybe it does have some headers, which IDA fails to recognize, so it loads those headers at 0, and the real binary a few bytes behind where it should be.

For the sake of this example, let's assume the firmware is supposed to be loaded at address 0x1000, while IDA loaded it at 0x0000 - you can specify the load address when you first open the binary; if you don't change it, the default is 0.

Now, a string that is supposed to be at address 0x1234 in the running binary will be located at 0x0234 in your IDA database. But the processor instruction in your code will still use 0x1234. But because IDA doesn't find anything sensible there, it will just assume it's a number, or maybe there is something there, but it won't be your string, so IDA might put a label at that point, but it won't recognize the connection with your string.

So what you really should do is try and find out if a) the firmware has some headers that don't belong to the binary, in which case you should remove them before analyzing, and b) which address the firmware belongs to, and make sure you state that address when analyzing.

I'm afraid your work with locating and tagging the strings manually was in vain; IDA does have commands to relocate a binary and adjust references, but these assume the binary is loaded/analyzed/crossreferenced correctly in the first place. Relocating your binary now won't help you as those crossreferences just aren't there.

  • It isn't a long shot, it is a very standard situation, but marking strings can be useful. If you can find some assembly instruction which may point to the string (such as ADDR in Arm) you can do the following - collect all such commands you have in the code IDA recognized as such. Collect addresses of these strings. Find a common delta between current string address in which you have more hits to starts of strings with ADDR arguments, and this will probably help you to calculate a new base address of the binary. – w s Apr 17 '16 at 11:51

Not the answer you're looking for? Browse other questions tagged or ask your own question.