0

This question has already been asked here but for some reason it was deleted, as "dead".

I will try to explain again. I have a specific data type. It is used in a large number of disassembled functions. This type has a field whose purpose is unknown. I need to find all references to this field in the entire application.

I can belive to @Biswapriyo, that this behavior is by design and I cannot find xrefs to the field of data type. Ok, got it. Now I need to find a way to do that! :)

Perhaps there are any plugin? I don't understand why this can be difficult, since to perform this action, it is enough to generate a .c file, open it in notepad and press Ctrl+F. I want this functionality to be in IDA Hex-Rays.

2 Answers 2

3

IDA does support structure member cross-references: it will show you everywhere in the disassembly listing that an instruction operand has had that particular structure reference applied to it. See this picture: IDA structure cross-references

However, this only works if the structure has been applied on the assembly-language level. Generally speaking, changing the type of a variable in Hex-Rays does not result in structure cross-references being created. Personally, I think this should be standard behavior.

Nevertheless, there's a Hex-Rays plugin called Referee that automatically adds assembly-level structure references based on the Hex-Rays types. There's also an IDAPython port of Referee. At the time of writing, neither the C++ nor the IDAPython version has been ported to the latest IDA 7.x SDK.

1
  • Just checked new "global cross references to..." in the last version of IDA. It works like a charm but you have to press "Refresh" button manually to get actual references to take into account your changes.
    – Albeoris
    Commented Aug 25 at 9:47
2

(Since I can't add comments due reputation) I ported IDAPython version of Referee to IDA 7.x (works on 7.5 good so far) Repository is here

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.