How can I get IDA Pro to "see" xrefs to a string?

assembly ida
Mike picture Mike · Dec 19, 2009 · Viewed 13.1k times · Source

Currently, I'm disassembling a Mach-O executable in IDA Pro. I've gone through and found the string I'm interested in, but when I try to find xrefs to it, none can be found. I'm sure that the strings are referenced in the original code, but IDA Pro doesn't seem to be able to find out how they are referenced.

Are there any tricks that can be performed to get IDA Pro to see the xrefs?

Answer

wallyk picture wallyk · Dec 19, 2009

Have you given it enough time for it to have analyzed the entire program? If there is a reference, it might be some time before it finds it in a large program.

It's also possible that it is referenced by instructions for which IDA can't find a flow path to. This can happen with jump tables where IDA isn't able to guess the size of the table. The reason for the I in IDA is that you look at the instructions which need judgment and proper interpretation and set them to the appropriate type so IDA can do most of the work.

Related questions

IDA pro asm instructions change

I just want to know how I can change asm instructions in the IDA-view A: How to edit instructions(for instance: jnz to jmp)? How to insert new instructions(call func1, call func2 inserted to existing code)? I know how …

Read More
How does one change an instruction with a hex editor?

I am messing around with some reverse engineering, but I don't know how to change a jnz to jz with a hex editor. I understand it will vary between systems but I'm not sure where to look to find this …

Read More
mov eax, large fs:30h

I was analyzing some x86 binary and found the following instruction which I can not understand. Can someone please explain me following instruction? mov eax, large fs:30h I googled this, and it turns out it is some anti-debugging stuff... …

Read More