1

I'm currently learning to use IDAPython for automated analysing on many binaries. Some binaries load memory address into register by adding base address with offset, that idautils.XrefsTo() cannot detect. In example:

enter image description here

enter image description here

However, IDA-View can detect that reference kind. My question is, is there any other IDAPython api can detect that, or anyone knows the script behind IDA-View which can do that? Thank you.

Improve this question

1 Answer 1

Reset to default
1

I'm not 100% sure but I believe IDA-View did not recognize the operand as an offset in your case. Otherwise it'd have disassembled it as addi r4, r9, offset aTelnet ; "TELNET" or something similar. To convert an operand to an offset, you can try the idc.op_plain_offset() function. I can't tell the exact syntax for your case as I don't have the addresses but it'll likely be something like idc.op_plain_offset(ea, 2, idc.get_segm_start(ea)) assuming ea is the instruction address, 2 is the operand index (3rd operand) which is the offset and the base address is the beginning of the segment this instruction belongs to.

Hope that helps.

Improve this answer
1
  • IDA must use some technique to store or track values of the registers because it statically analyses the binary instead of debugging, in this case is r9. Your suggestion actually is the final step of that technique. I'm wondering how IDA can do it.
    – Anh Pham
    Commented May 14, 2020 at 9:20

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.