Igor’s tip of the week #17: Cross-references 2 – Hex Rays

Cross references view

The jump to xref actions are good enough when you have a handful of cross-references but what if you have hundreds or thousands? For such cases, the Cross references view may be useful. You can open it using the corresponding item in the View > Open Subviews menu. IDA will gather cross-references to the current disassembly address and show them in a separate tab. It’s even possible to open several such views at the same time (for different addresses).

Adding cross-references

In some cases you may need to add a manual cross-reference, for example to fix up an obfuscated function’s control flow graph or add a call cross-reference from an indirect call instruction discovered by debugging. There are several ways to do it.

• In the Cross references view, choose “Add cross-reference…” from the context menu or press Ins. In the dialog, enter source and destination addresses and the xref type.
  
•  For indirect calls in binaries for PC (x86/x64), ARM, or MIPS processors, you can use  Edit > Plugins > Set callee address (Alt–F11).
  
• To add cross-references programmatically, use IDC or IDAPython functions add_cref and add_dref. Use the XREF_USER flag together with the xref type to ensure that your cross-reference is not deleted by IDA on reanalysis:
  add_cref(0x100897E8, 0x100907C0, fl_CN|XREF_USER)
add_dref(0x100A65CC, 0x100897E0, dr_O|XREF_USER)