0

I have two simple questions in IDAPro:

  1. How can I find string references in one function only (not the whole program) ?

  2. How can I breakpoint on each string reference in IDAPro ? It is easy to do in OllyDbg but I don't know how to do it in IDAPro ?

2 Answers 2

2

You'll need to learn IDAPython if you want to automate things in IDA. For your specific task, here is an example:

 # I didn't check this code, use carefully, beware of errors

import idc
import idaapi
import idautils

def set_breakpoints_on_refs(ea):
    list_of_referencing_functions = ["All"]
    print "In setting bp ..."
    for ref in idautils.DataRefsTo(ea):
        func_name = idaapi.get_func_name(ref)
        if not func_name is None and not func_name in list_of_referencing_functions:
            list_of_referencing_functions.append(func_name)
    print "refrlist done", list_of_referencing_functions
    width = 0
    for r in list_of_referencing_functions:
       if len(r) > width:
           width = len(r)

    ch = idaapi.Choose(list_of_referencing_functions, "Choose a function", 1 )
    ch.width = width
    print "Chooser created"
    res = ch.choose()
    if res > 0:
        print "selected ...", 
        chosen = ch.list[res -1]
        print chosen
        set_at_all = False
        if chosen == "All":
            set_at_all = True

        for ref in idautils.DataRefsTo(ea):
            if set_at_all:
                idc.AddBpt(ref)
                continue
            func_name = idaapi.get_func_name(ref)
            if func_name == chosen:
                idc.AddBpt(ref)


def set_breakpoints_on_refs_to_screen_ea():
    print "Started"
    set_breakpoints_on_refs(idc.ScreenEA())

idaapi.add_hotkey("Alt-Y", set_breakpoints_on_refs_to_screen_ea)

Running this code from execute script window will register hotkey Alt-Y that will do the following:

  • will get the current screen ea (let's assume that you placed the cursor on desired string),
  • create a list of functions that containing references to this ea
  • will ask you to choose one of them or all
  • and will set breakpoints on corresponding references (all or in chosen function)
0

For the refs, you can sort the list of xrefs and look only at a specific group:

enter image description here

For the string ref thing, you should put a hardware breakpoint on access on the string, like this:

enter image description here

1
  • I know that method but I want to have automated way right click inside a function and select show string reference in that function and break point on them directly...the reason is that I do this operations a lot Jul 28, 2015 at 23:19

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.