3

Is it possible to see a kind of statistics in IDA about functions and how often they are referenced? When analyzing a program, I find it helpfull.

Functions that are referenced very often typically are common functionality. An example would be stuff like strcmp(), malloc()/free(), strlen(), etc..

Some of those are quite easy to identfiy (like a strcmp() implementation), and giving a name to those functions early on, makes the analysis of the rest more easy.

7

There might be an easier way to get the count XrefsTo a certain function, but this worked for me.

from idaapi import *
funcs = Functions()
for f in funcs:
   name = Name(f)
   print "%s %d" % (name, len(list(XrefsTo(f))))
3

The following code is taken from GreyHat Python, and is very similar to the previous answer:

from idaapi import *
funcs = ["malloc","free","strcmp"]

for f in funcs:
   curAddr = LocByName(f)
   if curAddr != BADADDR:
      xrefs = CodeRefsTo(curAddr,0)
      print "Cross References to %s" % f
      for ref in xrefs:
         print "08x" % ref
         SetColor(ref,CIC_ITEM,0x0000ff)

This function will also highlight the call to make tracing it easier

  • 1
    This assumes the functions are already named, while @Devolus wants to identify these common functions (when the names are not known yet) by first inspecting functions with high XREF counts. – ixje Nov 2 '13 at 8:05
  • I know, but I thought the information might still come in handy. – Fewmitz Nov 3 '13 at 0:52

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.