Im trying to find where this subroutine is being called in IDA. I use xrefs to see where the subroutine is being called and I NOP the all the calls in all the subroutines in the xrefs. I do this for all the calls in the xrefs so nothing is calling this subroutine but the code in the subroutine is still being ran ingame and im so confused. is there some other place other than the xrefs where the subroutine is being called? thanks for the help
1 Answer
The xrefs provided by IDA cover only the common ways to call a function. As an developer you could generate the function address using complex mathematics and then call the function. Such calls can't be detected by IDA - that is the general limitation of static analysis.
BTW: Why do you NOP the function calls instead of just "NOPing" the function itself ?
You could modify the function in a way that it does nothing: the first command jumps to the end of the function or modify it so that it directly exits the function without doing anything. Therefore it would not matter if you manage to find all code positions where the function is called.
-
I'm reversing a game and trying to find where the subroutine is being called, so I used NOP each one in xref till I find the subroutine that calls that subroutine. Is there no way I can find where its being called due to the limitation in IDA?– J. DoeCommented Mar 3, 2020 at 18:21
-
1@Idafox: This is not a limitation of IDA this is a limitation of any static analysis tool. There are just tools that find some and other tools that find more references. If you really want all references you should switch to dynamic analysis (e.g. connect IDA to the running process and set a break-point on the function you are interested in).– RobertCommented Mar 3, 2020 at 18:24