Igor’s tip of the week #17: Cross-references 2
Cross references view
The jump to xref actions are good enough when you have a handful of cross-references but what if you have hundreds or thousands? For such cases, the Cross references view may be useful. You can open it using the corresponding item in the View > Open Subviews menu. IDA will gather cross-references to the current disassembly address and show them in a separate tab. It’s even possible to open several such views at the same time (for different addresses).
In some cases you may need to add a manual cross-reference, for example to fix up an obfuscated function’s control flow graph or add a call cross-reference from an indirect call instruction discovered by debugging. There are several ways to do it.
- In the Cross references view, choose “Add cross-reference…” from the context menu or press Ins. In the dialog, enter source and destination addresses and the xref type.
- For indirect calls in binaries for PC (x86/x64), ARM, or MIPS processors, you can use Edit > Plugins > Set callee address (Alt–F11).
- To add cross-references programmatically, use IDC or IDAPython functions
add_dref. Use the
XREF_USERflag together with the xref type to ensure that your cross-reference is not deleted by IDA on reanalysis:
add_cref(0x100897E8, 0x100907C0, fl_CN|XREF_USER)
add_dref(0x100A65CC, 0x100897E0, dr_O|XREF_USER)