I have string at address 0xaaaa that I want to know the address of function that use this string

import idautils

return 0

Why is that ? When I tried this code with function address that work.

So how can I find the address of function that using string that located at 0xaaaa address?

1 Answer 1


From idautils reference:

    ea - Reference address
    flags - one of ida_xref.XREF_ALL (default), ida_xref.XREF_FAR, ida_xref.XREF_DATA 

Strings are usually (precisely always, unless some crazy binary editing comes into play) stored in the data segment, so you can try the data segment flag (ida_xref.XREF_DATA).


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.