When i see function like this, im getting confused, because all the strings i need in this function, but how can i find which functions which this strings? how can i know the address of the function that using one of these string from the list? thx for helping
-
Could you show sub_EAF404? – bart1e Jul 17 '19 at 10:28
-
1please remember to post code as a text next time. – Paweł Łukasik Jul 19 '19 at 6:39
If you're using IDA, you can select the string (e.g. aImportSites_0
), right click and select Jump to xref to operand...
(keyboard shortcut -> x) and that will show you where (and which functions) reference this string. (The same thing applies for any other label, like functions name, variables etc.)
ida_strcluster is a nice plugin that can help you group the strings by function (among other things)
-
Hey, thanks for the answer, but there is no xref for the strings, only to this function, and i tried to install the plugin but it wont work for some reason. – Yoni Jul 16 '19 at 5:44
-
In your case the app (FlashFXP) supports different languages, so the code segment you asked about is initializing the strings by id. I'm assuming English is the embedded default and the rest of the languages are in dlf files somewhere. – BarCo Jul 16 '19 at 7:57