I am reversing a BIOS and its code extensively uses SP register for 16-bit return addresses (and also things like "bswap ESP" to obtain a "two-level-deep" stack, and rarely "mov mm7, esp" to obtain a "4-level-deep" stack etc).

It seems IDA does not track SP-related statements, even simple sequence of "mov SP, F123h" (inside the "caller" subroutine) followed by "jmp sp" (inside the "callee" subroutine) is not recognized. Therefore IDA can't show me a proper proximity view and I have to track the SP value and the whole control flow by hand.

Is there a way to automate this process?

I've read that I can add XREFs manually using ALT+F11. When I press ALT+F11 the callee dialog appears, but after I enter the address and click OK nothing happens. At least nothing visible.

Why? Is it supposed to work only for "call" instructions, but not for "jmp"s? If not, where does the cursor have to be placed before pressing ALT+F11?

P.S. I'm using IDA Pro 6.8.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.