IDA - How do I find every call to a sub

Question

I'm using IDA to try and understand how a particular executable works. I've found the routine I'm interested in IDA Pro and it all makes perfect sense, in so much as I can see exactly the process play out as I'd expect.

What I'm very confused about, though, is that I get to the top of the routine and I can't find any calls of references to it. To be clear, this is an executable and there are no exported functions - it's actually a Windows service.

If I right click and List Crossreferences I just a get single line in rdata? Is there anyway to find what calls this routine?

Answer 1

Short of debugging it and adding a hardware breakpoint on the vtable/vfunction, this may give you some additional information. Whether it is enough, or whether it will work in this case, I cannot say.

1. Install and run the Class Informer plugin.

2. Go to that xref you mentioned, and scroll up until you hit the start of the vtable. Note that it is possible that it is not actually a virtual function, in which case you just keep scrolling up an endless list of offsets and these steps will be of no help.

.rdata:0000000141A0E088 ; const BonusEventHttpTask::`vftable'
.rdata:0000000141A0E088 ??_7BonusEventHttpTask@@6B@ dq offset HttpTask__m_0
.rdata:0000000141A0E090                 dq offset return_null
.rdata:0000000141A0E098                 dq offset HttpTask__m_10
.rdata:0000000141A0E0A0                 dq offset HttpTask__m_18
.rdata:0000000141A0E0A8                 dq offset return_1
.rdata:0000000141A0E0B0                 dq offset return_0
.rdata:0000000141A0E0B8                 dq offset return_0
...

3. Click on the mangled name that is the vtable name, in this example it is ??_7BonusEventHttpTask@@6B@

4. View Xrefs (press X)
   You should generally see around 2 XREFS, these being for the constructor and destructor.

5. Take a look at both/all xrefs, and if you're lucky you'll see something like the below, though the first parameter will most likely be __int64. You can change that to UnknownStruct* (included below) by selecting a1, pressing Y and typing UnknownStruct*

CPickupPlacement *__fastcall CPickupPlacement::__construct(CPickupPlacement *a1, 
        int a2, Vector4 *position, Vector4 *rotation, int a5, int a6)
{
    // ... 
    pPickupPlacement->__vftable = &CPickupPlacement::`vftable';
    //... 
    return pPickupPlacement;
}

6. In this example the created [virtual] class is being returned, so you will then need to view the xrefs to the function you are viewing, and perhaps one will look like this:

//...
    v14 = pPickupPlacement ? CPickupPlacement::__construct(pPickupPlacement, a2, a1, a3, a4, a8) : 0i64;
    // ...
    qword_140000000 = v14;
// ...

7. If you are very lucky and this is indeed the case, you can view all xrefs to qword_140000000 and get a list some of the functions that are calling your virtual function. If you are less lucky, you will have to keep following the functions back (via xrefs) and hope that you do find an instance (groan) of your function being assigned to a "global" variable similar to the above point.

8. There are further steps that can be followed depending on what you find, but I think this is enough to get you headed in the right direction.

Here is the definition for UnknownStruct references in point 5. Open "Local types" and press Ins then paste in:

struct UnknownVtable {
    void* Function[1024];
};

struct UnknownStruct {
    UnknownVtable* vtable;
    __int64 qword[1024];
};