Idapython: adding links where a function address is loaded into a register

Question

I'm writing an Idapython loader script to help reverse-engineer the firmware on an embedded system with a 68000 processor.

Unfortunately I can't get a copy of the original C compiler used in order to build FLIRT signatures, but I would like to use Idapython to give IDA hints about some of the optimisations it's done.

As an example - the compiler often does things like this:

MOVEA.L   #sub_1234, a4
...
JSR       (a4)

The optimisation is, it's using an address register to hold the address of the function, which saves code space when one function is called several times.

I think I can figure out how to search for these patterns in the code -- but how can I tell IDA that "(a4)" is really a reference to sub_1234?

Answer 1

Come to think of it, apart from my other answer, there's a feature of IDA that I forgot: put your cursor on the call and do Edit->Plugins->Change the callee address (Alt-F11).

Answer 2

IDA doesn't accept "hints" along those lines, but you can create the cross-references manually via script. If you know the address of the destination, you can add an out-going cross-reference from the source address to the destination using add_cref. These will show up if you press ctrl-X at the destination, or X at the source. You can also add a comment at the call site with the target address, which will result in basically a "hyperlink" that you can double-click or press 'enter' with your cursor over.