I am working on an IDAPython script that is supposed to fix the disassembly of a firmware, by resolving it's symbol table.

The core of the script is working fine, but I have some issue when it comes to editing the way IDA is displaying stuff in the disassembly panel.

The idea is the following:

I have an original instruction like:

LDR          R1,=0xAAAAAAAA

After the execution of my script, the offset 0xAAAAAAAA is resolved into it's current value, let's say 0xBBBBBBBB, and it adds a comment next to the original instruction:

LDR          R1,=0xAAAAAAAA ; symbol_address=0xBBBBBBBB, symbol_value='DummyString'

But since I'm only adding a comment, I'm loosing the xRefs to and from the strings.

What i want to achieve is to edit the instruction itself, so IDA can create the xRefs to the Strings. Something like:

LDR          R1,=aDummyString 

I used this snippet to edit the operand address, which is working:

create_strlit(resolved_addr, 0, STRTYPE_C) # Defined the resolved string's addr as a proper string
new_inst = original_ins.replace(hex(original_addr), hex(resolved_addr))  # Simplified for clarity
set_manual_insn(addr, new_inst)            # Edit the instruction with the new resolved addr

But my disassembly view does not make the link between the address and the string itself.

LDR          R1,=0xBBBBBBBB

When i hover my cursor on 0xBBBBBBBB, i can see the correct string; When I click on this address, IDA takes me to the string's location. But it has not created any proper xRefs, and the display does not inform me that this is a string location.

I tried theses functions to turn the operand into a string reference, but without success:

op_plain_offset(addr, 1, 0)
op_offset(addr, 1, REF_OFF32)    # I also tried REF_OFF8 and REF_OFF16, just in case

But it does not update the disassembly view as I want.

And when i try to do it by hand by doing "right click" -> "Enter the current operand manually", it works fine :/

Any suggestion how to do that ?


1 Answer 1


Well, I managed to do it with the add_dref() function:

add_dref(frm, to, type)
Create a data cross-reference.


    to - linear address of referenced data (C++: ea_t)
    type - cross-reference type (C++: dref_t)

Returns: bool
    success (may fail if user-defined xref exists from->to) 

So I can just call this for every resolved symbols:

add_dref(instruction_addr, resolved_symbol_address, 1)

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.