When I try to disassemble proprietary ARM binaries (no symbol), like Android phone's boot loaders, I find there are a bunch of strings that do not have any "Xrefs to" in IDA Pro.
The image has already been rebased, and some strings have the Xrefs, while others do not. IDA does not recognize some of them as strings or data. Also, I tried to search the address as byte sequence, there is no result too.
Any good practices to find how these strings are referenced?
There's really no standard way.
It's possible that the code that references them isn't recognized as code, which would make it just a matter of defining it.
It's possible that they're referenced indirectly, like to an array - is there a value somewhere before them that's referenced?
It's possible that they're referenced indirectly in some way that IDA doesn't recognize it.
It probably won't work great for Android, but I've had luck using a break-on-read watchpoint on a string like that to find out where it's referenced from.
