There is a situation where the number of xrefs for a function is dynamically increasing due to the dynamic creation of memory with execution rights attached by VirtualAlloc.
I want to get the xrefs of the function, and in this situation, if I check manually in the UI, I get 8 references, but if I use IDAPython to get CodeRefsTo/XrefsTo, I only get 3.
This is probably due to the fact that IDAPython does not allow xrefs to be applied to code regions dynamically allocated by VirtualAlloc, or because the cache is not updated. What is the best way to get dynamically changing xrefs with IDAPython ? Can you give me some ideas?
Add a comment
|
2 Answers
Unfortunately i can not write a comment thus i have to write an answer if i want to reply. Maybe you could write a script to scan the memory for that functions address or even scan for the bytes of call functionaddr using idc.find_binary. Ofc that would only work if there are no offsets used.
-
Thank you for your comment. I already know the address of that function(function A), so I want to get dynamically not the function(function A) but the many other caller’s address that reference(xrefs) that the function(function A) address with IDApython. Mar 22, 2021 at 13:11
-
yes but idapython has the module idc. So knowing the address of the function that you want the xrefs to you could search for the bytesequence of "call functionaddress". That should atleast yield you some of the calls to it. I dont know how to perform the ida-internal x-ref scan though in idapython. Mar 22, 2021 at 14:10
-
Thank you for your comment. After that, I could solved the problem by using "plan_and_wait()". Your idea will be great too. Thank you. Mar 23, 2021 at 4:30
-
@rouqwers please add an answer if you found a solution so others can benefit from it– Igor Skochinsky ♦Mar 24, 2021 at 0:18
-
My question was resolved by doing the following. This is an answer.
If you want to update xrefs, at any given time, do the following.
plan_and_wait(minaddress, maxaddress)
It was effective to narrow down the scope of the project to a certain extent, because doing it in all areas would have been time consuming.