Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Deep Scan Variable on existing structures #62

Open
Frago9876543210 opened this issue Jul 4, 2020 · 2 comments
Open

Deep Scan Variable on existing structures #62

Frago9876543210 opened this issue Jul 4, 2020 · 2 comments

Comments

@Frago9876543210
Copy link
Contributor

I got binary file with debugging information and would like to find all cross-references to an existing field, that added automatically during the first analysis

@igogo-x86
Copy link
Owner

Could you demonstrate an example with that problem? I'm not sure that I correctly get it.

If it is related to not being able to scan struct pointers that only declared but not defined then you may find useful setting scan_any_type = False in $IDA_DIR/cfg/HexRaysPyTools.cfg

@Frago9876543210
Copy link
Contributor Author

Frago9876543210 commented Jul 14, 2020

Let's look at the real case. This program is compiled with debugging information and all types are already known after analysis. However, option "deep scan variable" can't find all xrefs to Foo.x until you decompile all functions that reletated to it

#include <cstdio>

class Foo {
public:
	int x, y, z;

	Foo(int x, int y, int z) : x(x), y(y), z(z) {} //xref to Foo.x

	void plus(int x1) {
		this->x += x1; //xref to Foo.x
	}

	void minus(int x1) {
		this->x -= x1 * 2; //xref to Foo.x
	}
};

int main() {
	Foo foo = Foo(10, 20, 30);
	foo.plus(10);
	foo.minus(10);

	printf("%d, %d, %d\n", foo.x, foo.y, foo.z); //xref to Foo.x

	return 0;
}
g++ test.cpp -o test -g3

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants