Now the string has a cross-reference and you can look further at where exactly it is used:īinary search works for addresses embedded as-is into the binary. To convert it to an offset so that xref is created you can usually use the O or Ctrl– O shortcuts, or the context menu: The value may be initially displayed as a raw number or even separate bytes. IDA will automatically convert the value into a byte sequence corresponding to the processor endianness and look for it in the database: It is also recommended to enable Match case to avoid false positives: Paste the address and make sure that Hex is selected.Invoke binary search (Search > Sequence of bytes…, or Alt– B).Go to the start of the database ( Ctrl– PgUp or Home, Home, Home).Select and copy to clipboard the string’s address ( C3E31B49).In such case, looking for the address value should discover it.įor example, here’s a string in an ARM firmware which currently has no cross-references: One possibility is that the string is referred to by its address value, either from a pointer somewhere, or as an immediate value embedded directly in the instruction (the latter case is more common for CISC instruction sets such as x86). How to discover where? Finding addresses using binary search in the String list) which has no cross references, but you’re reasonably sure it’s actually used. Let’s say you found a string in the binary (e.g. When analyzing firmware or other binaries without metadata, IDA is not always able to discover and analyze all functions which means the cross-references can be missing.

Ida hexray