4

What is the best method to enumerate all xrefs to addresses in a particular segment? I came up with a brute-force approach (as seen below). The code scans each address in a segment and checks for an XrefTo the address.

seg_list = []
for seg in Segments():
    seg_list.append(seg)

# logic will be added to remove section that are code later
seg_list.reverse()
for seg in seg_list:  
    start = SegStart(seg)
    end = SegEnd(seg)
    while start < end:
        gen_xrefs = XrefsTo(start, 0)
        for xx in gen_xrefs:
            print hex(start), hex(xx.frm)
        start += 1

This approach is very time consuming if I have multiple large segments. IDA adds DATA XREF comments when viewing the data manually. Are these xrefs stored in an accessible way from IDAPython or is there another more practical approach to find the xrefs to a segment?

mem_15d:00973000                 dd 1C8h dup(0)
mem_15d:00973720 dword_973720    dd 101011Ch, 1000h      ; DATA XREF: mem_f08:00970678o
mem_15d:00973728 off_973728      dd offset off_970178    ; DATA XREF: mem_f08:off_970178o
mem_15d:00973728                                         ; mem_f08:0097017Co 

Note: Enumerating all xrefs from the code is not an option.

4

You can use Heads function from idautils module. So your code will look like that:

import idautils
seg_list = []
for seg in Segments():
    seg_list.append(seg)

# logic will be added to remove section that are code later
seg_list.reverse()
for seg in seg_list:  
    start = SegStart(seg)
    end = SegEnd(seg)
    for ea in idautils.Heads(start, end):
        gen_xrefs = XrefsTo(ea, 0)
        for xx in gen_xrefs:
            print hex(ea), hex(xx.frm)
  • And I thought idautils.Heads was just for code. Thanks for the answer. – alexanderh Feb 12 '14 at 19:11
  • There may be xrefs to addresses which are not a Head, like xrefs to undefined data, or xrefs into strutures. – Willem Hengeveld Mar 27 '14 at 19:30

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.