2

Analysing a bootmanager : I'm trying to track all variables which are only read from, and not written to... which will give me the external variables it uses...

Is there any such functionality in IDA pro free? Can I write a plugin for it in the free version? Any other options for this purpose? Any other tool which can do this?

4

Since you are only interested in variables that are read from, not written to, I'll assume you're talking about global variables since it makes no sense to have a local variable that's never written to.

You can write an IDC script to iterate through each global variable and use RfirstB, RnextB, and XrefType to determine which global variables are read from, written to, or both.

  • 2
    That's a good answer. One thing to note is that memory references through indirect memory addressing (pointers) won't be tracked explicitly in IDA (or any publicly-available reverse engineering tool). I.e., to know what memory is being read or written to by a char ** type, you have to know where it points. Another example is accessing an array of structures. This often happens in a loop, where some base pointer or index variable is updated for each iteration, and will not leave direct memory references to the individual array elements. – Rolf Rolles Feb 7 '14 at 21:41
  • 1
    I actually understood what you meant about global variables now, after reading up on the way they are stored differently from local ones. Thanks, will get familiar with IDC now. – Milind R Feb 14 '14 at 20:00

Your Answer

By clicking "Post Your Answer", you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.