When I try to disassemble proprietary ARM binaries (no symbol), like Android phone's boot loaders, I find there are a bunch of strings that do not have any "Xrefs to" in IDA Pro.

The image has already been rebased, and some strings have the Xrefs, while others do not. IDA does not recognize some of them as strings or data. Also, I tried to search the address as byte sequence, there is no result too.

Any good practices to find how these strings are referenced?


There's really no standard way.

It's possible that the code that references them isn't recognized as code, which would make it just a matter of defining it.

It's possible that they're referenced indirectly, like to an array - is there a value somewhere before them that's referenced?

It's possible that they're referenced indirectly in some way that IDA doesn't recognize it.

It probably won't work great for Android, but I've had luck using a break-on-read watchpoint on a string like that to find out where it's referenced from.

  • If referenced indirectly, I can find the address as byte sequence in IDA or other tools like 010 Editor, right?
    – WindChaser
    May 18 '17 at 5:08

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.