I'm using IDA Pro 6.9 with some PowerPC disassembly. The code sets up r13 to a value, say 0x10000, then offsets that register to load and store memory in that region. r13 is never modified again in the code, it is only used for loading/storing data by offsetting.

e_stb     r7, -0x56E2(r13)

I'm hoping there is a way to tell IDA the value of r13 so that it will automatically generate a reference to the correct memory location so that I get something like:

e_stb     r7, -0x56E2(r13) # Named_Location

As well as the value at that location when I hover with the mouse.

Update:
Igor Skochinsky gave what is the correct answer but didn't fix my specific problem.

The answer seems to have worked anywhere r13 is used in an add instruction, e_add16i r31, r13, -0x2DF2 # unk_4000ADE2 but is not working for direct relative load/store instructions, e_stb r3, -0x2E08(r13) (no variable name, offset in red).

This might be a bug in IDA.

up vote 1 down vote accepted

Just set it in processor options.

enter image description here

  • So this seems to be exactly what I want, completely missed that option when I was poking around. However, when I set this value and force a reanalysis IDA doesn't update the instructions, it shows the e_stb r7, -0x56E2(r13) as before, no changes. Also, if it helps, the offset, -0X56E2 is red which seems to indicate IDA is trying to do something with it. Have any other ideas? I'll mark your answer accepted as this does seem the right way, just something isn't working for me. – Joe Jul 21 '16 at 13:16
  • Ok, so the answer seems to have worked anywhere r13 is used in an add instruction, e_add16i r31, r13, -0x2DF2 # unk_4000ADE2 but is not working for direct relative load/store instructions, e_stb r3, -0x2E08(r13) (no variable name, offset in red). – Joe Jul 21 '16 at 13:21
  • Does the final address exist? If yes, send a bug report. – Igor Skochinsky Jul 21 '16 at 17:37

Regarding the potential bug in IDA:

First of all, you can add references yourself with idaapi.add_cref and idaapi.add_dref IDAPython APIs. This may be done with relatively simple script like this:

import idaapi
import idautils
import idc

predefined_r13 = YOUR_R13_VALUE

for h in idautils.Heads():
    dis = idc.GetDisasm(h) #probably there is another way to do it and parsing textual assembly is not the best option
    pos = dis.find ("(r13)")
    if pos != -1: #we have your register here
          splitted = dis[:pos].split() 
          lastarg = splitted[-1]
          lastarg_numeric = int(lastarg, 16)
          addr = predefined_r13 + lastarg_numeric
          idaapi.add_dref(h, addr, idc.dr_O)

Of course this script should be extended: the expression with r13 may be more complicated,the type of data reference may be different and it may be the code reference at all, and the problem is already solved for part of the cases as it is wrote in the answer by @Igor Skochinsky, but the general idea is illustrated pretty well.

In addition (if you want to override the work of disassembler) you can install your own disassembler module hook as @Rolf Rolles did in this article which will recompute all these things (you'll need to override idaapi.IDP_Hooks.custom_emu ), but adding data references is probably easier way to achieve your goal.

  • Thanks for the input and sample script. I'll probably end up doing something like that, a little too tedious to continue adding manual xrefs/comments. – Joe Jul 21 '16 at 14:21
  • btw, did you reanalyze the program after applying the r13 value in analyzer options (Options->General->Analysis->Reanalyze program) ? – w s Jul 21 '16 at 15:08
  • I did, that is when it got the add instructions correct, but not the load/store instructions. – Joe Jul 21 '16 at 15:31

Your Answer

 

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.