0

This question has already been asked here but for some reason it was deleted, as "dead".

I will try to explain again. I have a specific data type. It is used in a large number of disassembled functions. This type has a field whose purpose is unknown. I need to find all references to this field in the entire application.

I can belive to @Biswapriyo, that this behavior is by design and I cannot find xrefs to the field of data type. Ok, got it. Now I need to find a way to do that! :)

Perhaps there are any plugin? I don't understand why this can be difficult, since to perform this action, it is enough to generate a .c file, open it in notepad and press Ctrl+F. I want this functionality to be in IDA Hex-Rays.

2

IDA does support structure member cross-references: it will show you everywhere in the disassembly listing that an instruction operand has had that particular structure reference applied to it. See this picture: IDA structure cross-references

However, this only works if the structure has been applied on the assembly-language level. Generally speaking, changing the type of a variable in Hex-Rays does not result in structure cross-references being created. Personally, I think this should be standard behavior.

Nevertheless, there's a Hex-Rays plugin called Referee that automatically adds assembly-level structure references based on the Hex-Rays types. There's also an IDAPython port of Referee. At the time of writing, neither the C++ nor the IDAPython version has been ported to the latest IDA 7.x SDK.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.