I'm writing an IDA plugin using idapython in order to add comments (located in database) to variables of struct types. In order to do this, firstly, i need to get the list of cross-references to a given structure type (e.g. struct BITMAPINFO) which can be found in "Structure" subview in IDA.
I know IDA provides this function from version 6.2 by right-button mouse clicking on the structure name and selecting "List cross references to". A window like the following will be popped-up:
Each item of the list in above picture is either an address where a global variable of type %structure name% (here is BITMAPINFO) is declared or a position where a local variable of type "structure name" is defined. The former is like
I wonder if there is a way to get these data by IDAPython.
NOTE: This is different from cross-references to a(ll) member(s) of a struct type, which can be got by right-button mouse clicking on the structure member name, shown as the following
Before asking here, i do it like:
#CODE 1 ea = idc.LocByName(%structure name%) frm = [x.frm for x in idautils.XrefsTo(ea)]
I think i have got the whole list of cross-references to %structure name% using my above code. However, i found many EAs in the list seem like ineffective such as '0xff0052c9' (MaxEA is 0x108f800). However, i guess my code has got the desired result because the length of returned list is equal to the number of items in the list shown as the 1st picture. But i can't explain the result especially the (seemingly) ineffective ones. Also, when i add comments to the addresses in the list using the following code
#CODE 2 for ea in xrefs_list: # each cross-reference to the given struc type if repeatable: # add repeatable comment 'cmt' at address 'ea' idc.MakeRptCmt(ea, cmt) else: # add comment 'cmt' at address 'ea' idc.MakeComm(ea, cmt)
i found i only added comments to the effective addresses which are between idc.MinEA() and idc.MaxEA(), and these addresses are places where global instances of the queried struct type are declared, as shown in the 2nd picture.
My questions are:
- Is my above code (CODE 1) correct to get all cross-references to a struct type? If it is, how to explain those seemingly ineffective addresses (above 0xFF000000)
- How to add comments to other cross-reference addresses other than the references to global instances of the struct type?