7

I have an indirect call to a function. I traced the program and added the target to the xref, so this works fine. The problem is though, that on the position where the call is, there is no link shown. I thought, that, when I add an XREF, both positions are shown, because this is also the behaviour with the other referenzes, IDA automatically finds out.

To illustrate what I mean:

The call is here without showing me where it points to:

CODE:004A3F07 00C                 call    dword ptr [edx+28h]

The xref I added is here showing the link:

CODE:004A3390     DecryptMemory proc near            ; CODE XREF: sub_4A3EC0:loc_4A3F07 P

Is it possible to make IDA show the reference on both addresses? I know I can create a manual xref there as well, but then IDA creates a label as well, which makes it a bit confusing, when revisting. I tried to remove the label, but this doesn't work either (would this be possible?).

| improve this question | |
  • Did you try adding the xref the other way around? – ekse Oct 20 '13 at 13:57
  • 1
    Yes. That's why I said, that a label will be assigned. The problem is, that a lable is confusing in this case, because it looks as if this is a jump target, which it isn't. I guess it's still better than nothing, but I though that XREFs work in both directions, not only one. – Devolus Oct 20 '13 at 14:02
  • Just create a comment like this in addition to the fl_CN xref: gist.github.com/OALabs/… – Trass3r Oct 4 at 20:25
  • You are right, adding a back ref will create an assembly label at the callsite. Interestingly it doesn't accept an fl_F xref. – Trass3r Oct 4 at 20:40
7

IDA does not automatically show the xref existence at the source as you are claiming. In most cases it's not necessary, as the destination is usually printed as part of the instruction or data item.

However, for resolved indirect calls the processor module may display a comment to help the user. For some processors (including x86) you can use the "Change callee address" plugin (Alt+F11) to manually set the destination of an indirect call. It adds both an xref and makes the processor module print an auto-comment.

| improve this answer | |
  • I didn't claim that, quite on the contrary, I was complaining, that it doesn't do it. ;) Nevertheless, I try your suggestion with Alt-F11 and see if that helps. Thanks. – Devolus Oct 21 '13 at 6:25
  • In addition that command also annotates function arguments. Is it possible to call callee programmatically? – Trass3r Oct 4 at 20:22
2

You can create a free-form comment mentioning "004A3390" at 004A3F07. Anything that remotely resembles a valid reference is clickable in IDA Pro. Double-clicking 004A3390 in your comment will take you to the location.

| improve this answer | |
  • Yes, but it will not be updated if I change the name, and it is now show in the target as an XREF. I use this for now as a workaround, resp. adding manually the XREFs on both sides. – Devolus Oct 22 '13 at 10:20

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.