4

I'm working on a decompilation of a windows PE (with its full debug symbols in a PDB) and I'm using IDA to help with it.

I want to know how I can get a list of all references to a given class member variable. When I press 'X' in a name that is a class member variable in the decompiler window it only shows xrefs to it within the actual function being decompiled. I want to see the references in all of the functions. Is that even possible without coding a script?

Improve this question

3 Answers 3

Reset to default
5

The other answer is wrong; it's totally possible (assuming the IDB already has a type for the structure in question, and that type has been applied to arguments/variables in Hex-Rays).

In IDA 7.4 and above (I think; might have been 7.3), right-click the variable and press "Jump to xref globally", as follows:

Jump to xref globally

You'll get a popup with all global x-refs, as follows:

Global cross references

This is based on caching, so the first time you do it, you'll want to right-click and press "refresh" as in the image above (which will take a while for large databases, but is totally worth it -- this is one of my most frequently-used features in Hex-Rays).

Improve this answer
4
  • Thanks for the answer! Sadly my license expired at 7.1. How feasible would it be to be done through scripting? I don't have much knowledge of IDA scripting.
    – underthevoid
    Commented Nov 12, 2020 at 6:53
  • 1
    Pretty easy. Derive a class off of ctree_visitor_t, whose visit_expr methods looks for cot_memptr/cot_memref expressions. When such an expression x is found, compare x->type to your desired structure type. If it matches, you've found a place where that structure is used. To find accesses to a specific field, compare x->m against the offset of the field you want. To find this across the database, apply your ctree_visitor_t derivative to all functions in the database.
    – Rolf Rolles
    Commented Nov 12, 2020 at 7:09
  • Very nice @Rolf Rolles. Do you know of a plugin that already does that?
    – underthevoid
    Commented Nov 12, 2020 at 8:21
  • I don't. Such a plugin is not necessary, as the functionality is built in in later versions (see discussion above).
    – Rolf Rolles
    Commented Nov 12, 2020 at 16:13
0

referee python plugin from https://github.com/medigateio/ida_medigate does it pretty well

Improve this answer
1
  • While this link may answer the question, it is better to include the essential parts of the answer here and provide the link for reference. Link-only answers can become invalid if the linked page changes. - From Review
    – perror
    Commented Dec 6 at 13:38
-1

It's not possible. You have to recover the class instance structure, then pass through all class methods and apply the class structure where it's used. Then you go and see where the class is created and track where all its instances are used and make sure that you found all the access points to the public members of the class. Then you go to the structures window and look at all the xrefs for the member that you need.

Improve this answer
2
  • As I have the PE's PDB all the initial stuff you said can be gathered in the PBE. IDA already recognizes the structures and variables everywhere. The problem is just I can't figure out how to get a list with all the code that access a given variable. I think it should be very easy to do that with a script but I just thought it should be a default feature that I just don't know of.
    – underthevoid
    Commented Nov 11, 2020 at 11:14
  • The class structure must be present in the Structures window, then you go and apply it on the assembler, not the decompiled code. There's a video on how to do that youtube.com/watch?v=X3xCwNt2ZVY
    – Anton Kukoba
    Commented Nov 11, 2020 at 11:21

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.