When i see function like this, im getting confused, because all the strings i need in this function, but how can i find which functions which this strings? how can i know the address of the function that using one of these string from the list? thx for helping

enter image description here

  • Could you show sub_EAF404? – bart1e Jul 17 '19 at 10:28
  • 1
    please remember to post code as a text next time. – Paweł Łukasik Jul 19 '19 at 6:39

If you're using IDA, you can select the string (e.g. aImportSites_0), right click and select Jump to xref to operand... (keyboard shortcut -> x) and that will show you where (and which functions) reference this string. (The same thing applies for any other label, like functions name, variables etc.)

ida_strcluster is a nice plugin that can help you group the strings by function (among other things)

  • Hey, thanks for the answer, but there is no xref for the strings, only to this function, and i tried to install the plugin but it wont work for some reason. – Yoni Jul 16 '19 at 5:44
  • In your case the app (FlashFXP) supports different languages, so the code segment you asked about is initializing the strings by id. I'm assuming English is the embedded default and the rest of the languages are in dlf files somewhere. – BarCo Jul 16 '19 at 7:57

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.