4

What is the best method to enumerate all xrefs to addresses in a particular segment? I came up with a brute-force approach (as seen below). The code scans each address in a segment and checks for an XrefTo the address.

seg_list = []
for seg in Segments():
    seg_list.append(seg)

# logic will be added to remove section that are code later
seg_list.reverse()
for seg in seg_list:  
    start = SegStart(seg)
    end = SegEnd(seg)
    while start < end:
        gen_xrefs = XrefsTo(start, 0)
        for xx in gen_xrefs:
            print hex(start), hex(xx.frm)
        start += 1

This approach is very time consuming if I have multiple large segments. IDA adds DATA XREF comments when viewing the data manually. Are these xrefs stored in an accessible way from IDAPython or is there another more practical approach to find the xrefs to a segment?

mem_15d:00973000                 dd 1C8h dup(0)
mem_15d:00973720 dword_973720    dd 101011Ch, 1000h      ; DATA XREF: mem_f08:00970678o
mem_15d:00973728 off_973728      dd offset off_970178    ; DATA XREF: mem_f08:off_970178o
mem_15d:00973728                                         ; mem_f08:0097017Co 

Note: Enumerating all xrefs from the code is not an option.

1 Answer 1

4

You can use Heads function from idautils module. So your code will look like that:

import idautils
seg_list = []
for seg in Segments():
    seg_list.append(seg)

# logic will be added to remove section that are code later
seg_list.reverse()
for seg in seg_list:  
    start = SegStart(seg)
    end = SegEnd(seg)
    for ea in idautils.Heads(start, end):
        gen_xrefs = XrefsTo(ea, 0)
        for xx in gen_xrefs:
            print hex(ea), hex(xx.frm)
2
  • And I thought idautils.Heads was just for code. Thanks for the answer.
    – alexanderh
    Feb 12, 2014 at 19:11
  • There may be xrefs to addresses which are not a Head, like xrefs to undefined data, or xrefs into strutures. Mar 27, 2014 at 19:30

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.