How to get the recovered memory references in IDA-Pro? [duplicate]

Question

I want to collect all the IDA recovered symbol information in data sections (this information could be function name, or it could be an entry of jump table, or it could be a reference to other data sections).

Here is an example of data sections from a IDA disassembled binary.

Basically there are three recovered symbols in data section, and I want to collect these information in a format like this:

0x804a018 : sub_804847b
0x804a01dc : _strchr
0x804a020 : sub_80484AE

I am thinking to traverse all the memory address of a binary's data sections, and check the content of each address, to see whether it is a recovered symbol.

But basically how to read a suspicious symbol when iterating addresses? I read the idc interface, but I just cannot find any the correct api to do so. Could anyone help me on this issue? I appreciate that.

------------------------ explain ------------------------

I didn't get an answer in that post, in addition, I think what I explained in that post is somehow misleading.

Answer 1

As far as I understood your question, you will need the following IDAPython apis:

• Getting a content from specific memory address : idc.Dword(address) or idc.Qword(address) - you should choose the function according to the pointer size.
• Obtaining a name of the address: idc.Name(address)

All the mentioned IDAPython apis has the similar things in idc

So, for your specific example you'll get the desired output as follows (IDAPython):

import idc
addresses = [0x804a018, 0x804a01dc ,0x804a020 ]

for a in addresses:
    print hex(a)," : ", idc.Name(idc.Dword(a))

Filtering the data in the .data section is completely different story.

For example you can do the following (it is not 100% correct):

import idc

segstart = your_code_segment_start
segend = your_code_segment_end
ptrstep = your_system_pointer_size_in_bytes

for a in range(segstart, segend, ptrstep):
    data = idc.Dword(a) #replace with qword if working with 64 bit)
    if a < segstart or a >= segend:
        continue
    if not idc.Name(data) is None:
        print hex(a), " --> ", idc.Name(data)