I'm writing an Idapython loader script to help reverse-engineer the firmware on an embedded system with a 68000 processor.

Unfortunately I can't get a copy of the original C compiler used in order to build FLIRT signatures, but I would like to use Idapython to give IDA hints about some of the optimisations it's done.

As an example - the compiler often does things like this:

MOVEA.L   #sub_1234, a4
JSR       (a4)

The optimisation is, it's using an address register to hold the address of the function, which saves code space when one function is called several times.

I think I can figure out how to search for these patterns in the code -- but how can I tell IDA that "(a4)" is really a reference to sub_1234?


Come to think of it, apart from my other answer, there's a feature of IDA that I forgot: put your cursor on the call and do Edit->Plugins->Change the callee address (Alt-F11).


IDA doesn't accept "hints" along those lines, but you can create the cross-references manually via script. If you know the address of the destination, you can add an out-going cross-reference from the source address to the destination using add_cref. These will show up if you press ctrl-X at the destination, or X at the source. You can also add a comment at the call site with the target address, which will result in basically a "hyperlink" that you can double-click or press 'enter' with your cursor over.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.