Results 1 to 1 of 1

Thread: [IDA Pro] Fast way to get all xrefsto (no filthy WinGraph32)

  1. #1
    Assadministrator kung foo man's Avatar
    Join Date
    Jun 2012
    Location
    trailerpark
    Posts
    2,010
    Thanks
    2,102
    Thanked 1,083 Times in 753 Posts

    [IDA Pro] Fast way to get all xrefsto (no filthy WinGraph32)

    I played a bit with IDAPython, it's quite simple to print all references to a specific function:

    Make a file called dumpxrefs.py and edit the address as you need:

    Code:
    for xref in XrefsTo(0x080681A4, flags=0):
        print xref.type, XrefTypeName(xref.type),                          'from', hex(xref.frm), 'to', hex(xref.to)
    Or more dynamic, set a dialog to input the address when you call the script:

    Code:
    for xref in XrefsTo(idaapi.askaddr(0, "Enter target address"), flags=0):
        print xref.type, XrefTypeName(xref.type), 'from', hex(xref.frm), 'to', hex(xref.to)

    Open the file from this menu (meh, shorter way: File -> Python file...):

    Click image for larger version. 

Name:	a.png 
Views:	26 
Size:	21.4 KB 
ID:	1089

    Then just select dumpxrefs.py in the File Dialog and it will run, printing this in the console:

    Click image for larger version. 

Name:	b.png 
Views:	25 
Size:	30.3 KB 
ID:	1090

    You can copy the result then and paste it in your serious_insights_about_my_current_project.txt, because these xrefs are (at least for me) often the most important hints to get further clues about something.


    Documentation for IDAPython: https://www.hex-rays.com/products/id...dapython_docs/

    Interesting things done with IDAPython (by a malware analyzer): http://www.openrce.org/articles/full_view/11

    Oops, "File -> Python file..." is much faster.
    Last edited by kung foo man; 12th April 2016 at 04:22. Reason: Shorter way to python file dialog + no static address alternative
    timescale 0.01

  2. The Following User Says Thank You to kung foo man For This Useful Post:

    kubislav23 (24th December 2017)

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •