9

IDA has disassembled the following code:

seg019:C0292548             loc_C0292548                            ; CODE XREF: sub_C0292414+11Cj
seg019:C0292548 02 00 54 E3                 CMP     R4, #2
seg019:C029254C 0F 00 00 1A                 BNE     loc_C0292590
seg019:C0292550 F0 30 9F E5                 LDR     R3, =0xC0298608
seg019:C0292554 02 2C A0 E3+                MOV     R2, 0x205
seg019:C029255C 00 30 93 E5                 LDR     R3, [R3]
seg019:C0292560 02 00 53 E1                 CMP     R3, R2
seg019:C0292564 04 00 00 1A                 BNE     loc_C029257C
seg019:C0292568 D4 00 9F E5                 LDR     R0, =0xC02860F0
seg019:C029256C 53 FC FF EB                 BL      sub_C02916C0
seg019:C0292570 2B 30 A0 E3                 MOV     R3, #0x2B
seg019:C0292574 7F 20 A0 E3                 MOV     R2, #0x7F
seg019:C0292578 08 00 00 EA                 B       loc_C02925A0

If I hit enter on 0xC02860F0, it takes me to:

seg019:C02860F0 50                          DCB 0x50 ; P
seg019:C02860F1 00                          DCB    0
seg019:C02860F2 6F                          DCB 0x6F ; o
seg019:C02860F3 00                          DCB    0
seg019:C02860F4 77                          DCB 0x77 ; w
seg019:C02860F5 00                          DCB    0
seg019:C02860F6 65                          DCB 0x65 ; e
seg019:C02860F7 00                          DCB    0
seg019:C02860F8 72                          DCB 0x72 ; r
seg019:C02860F9 00                          DCB    0
[...]

Which is clearly a UTF-16 little-endian string. However, IDA hasn't created any of the appropriate cross-references (^X on the string doesn't list anything). How can I get it to do this? It seems to have done it automatically when I first loaded the code, but I have loaded additional segments since then and it hasn't done the same for them. I tried re-running the autoanalysis with no effect.

I suppose that I could go through the binary with IDAPython and manually create the references to anything that's listed in the Strings window, but this seems very cumbersome given that IDA normally does this for me.

Any ideas?

Improve this question
1
  • Have you tried undefining the segment before you use analyzearea on it?
    – Avery3R
    Commented Jun 11, 2013 at 1:39

2 Answers 2

Reset to default
13

At 0xC02860F0 hit Alt+A and select unicode to define it as a unicode string. IDA should recognize the reference after you do so.

Improve this answer
1
  • I think he means, how can he leverage IDA's automated analysis facilities to create the strings and the references in chunks of code / data that were loaded after the initial database was created, rather than how can he do it manually (seeing as IDA performs an analysis to do it automatically for the main binary).
    – Rolf Rolles
    Commented Jun 11, 2013 at 0:55
7

Press O (or Ctrl+O, depending on segmentation setup).

Improve this answer
3
  • 1
    That does the trick for one, thank you! Is there any way to automate this? There are quite a lot of references to fix and I'm trying to do an analysis that depends on knowing where strings are used throughout the program. Did I do something wrong when creating the segment?
    – Brendan Dolan-Gavitt
    Commented Jun 11, 2013 at 13:25
  • I've run into this issue as well on a number of occasions on ARM. It's weird. @BrendanDolan-Gavitt, are you above or below the suspiciousness offsets? Have you tried to run a reanalyze pass? As far as I can tell the issue is that during the first analysis pass the value gets marked as suspicious and during the second one it doesn't re-evaluate the suspiciousness of the value so it's not updated.
    – Peter Andersson
    Commented Jun 13, 2013 at 10:30
  • @PeterAndersson: The limits are 0x40011000-0xF1100000 and the address in question is 0xC02860F0. I have tried reanalyzing (Options->Analysis->Reanalyze program) but it doesn't seem to worked on that address (it did work for some others nearby, which is even stranger – I can't tell the difference between the cases). The segments are pieces of Windows CE kernel memory that were extracted and loaded into IDA with idaapi.load_binary_file.
    – Brendan Dolan-Gavitt
    Commented Jun 13, 2013 at 20:48

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.