A cross-reference, known as an xref in IDA Pro, can tell you where a function is called or where a string is used. If you identify a useful function and want to know the parameters with which it is called, you can use a cross-reference to navigate quickly to the location where the parameters are placed on the stack. Interesting graphs can also be generated based on cross-references, which are helpful to performing analysis.
Example 5-2 shows a code cross-reference at ❶ that tells us that this function (sub_401000) is called from inside the main function at offset 0x3 into the main function.
The code cross-reference for the jump at ❷ tells us
which jump takes us to this location, which in this example corresponds to the location marked at
❸. We know this because at offset 0x19 into sub_401000 is the jmp at memory address
0x401019.
Example 5-2. Code cross-references
00401000 sub_401000 proc near ; ❶CODE XREF: _main+3p 00401000 push ebp 00401001 mov ebp, esp 00401003 loc_401003: ; ❷CODE XREF: sub_401000+19j 00401003 mov eax, 1 00401008 test eax, eax 0040100A jz short loc_40101B 0040100C push offset aLoop ; "Loop " 00401011 call printf 00401016 add esp, 4 00401019 jmp short loc_401003 ❸
By default, IDA Pro shows only a couple of cross-references for any given function, even
though many may occur when a function is called. To view all the cross-references for a function,
click the function name and press X on your keyboard. The window that pops up should list all
locations where this function is called. At the bottom of the Xrefs window in Figure 5-6, which shows a list of cross-references for sub_408980, you can see that this function is called 64 times (“Line 1 of
64”).
Double-click any entry in the Xrefs window to go to the corresponding reference in the disassembly window.
Data cross-references are used to track the way data is accessed within a binary. Data
references can be associated with any byte of data that is referenced in code via a memory
reference, as shown in Example 5-3. For example, you can see the
data cross-reference to the DWORD 0x7F000001 at ❶. The corresponding cross-reference tells us that this data is
used in the function located at 0x401020. The following line shows a data cross-reference for the
string <Hostname> <Port>.
Example 5-3. Data cross-references
0040C000 dword_40C000 dd 7F000001h ; ❶DATA XREF: sub_401020+14r
0040C004 aHostnamePort db '<Hostname> <Port>',0Ah,0 ; DATA XREF: sub_401000+3oRecall from Chapter 1 that the static analysis of strings can often be used as a starting point for your analysis. If you see an interesting string, use IDA Pro’s cross-reference feature to see exactly where and how that string is used within the code.