I would like to know all the constants used for memory access except for non-pointer constants (e.g. argument) in IDA Pro.

Is there such a way?

1 Answer 1


Using Sark's lines for brevity, this should return all the cross-referenced data addresses (with duplicates):

import idautils, sark

for line in sark.lines():
    for ref in idautils.DataRefsFrom(line.ea):

This includes imports and their jump functions from .text section as those apparently are marked as data too.

  • In my case, I need to find access to physical memory address. In this case, isn't it possible to find all of them with just Xref?
    – user212942
    May 23, 2023 at 23:38
  • You cannot get a physical address with static analysis, you need to debug it. Physical addresses depend on the process, they are not static values
    – mimak
    May 23, 2023 at 23:53
  • I'm analyzing the firmware. This includes (int)0x32000000 = 0x12345678; It contains code like this. I want to get a constant like this.
    – user212942
    May 24, 2023 at 4:22
  • If your firmware uses static address translation, all you need to find is the base physical offset, you can calculate everything else
    – mimak
    May 24, 2023 at 13:13

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.