Download Reference - Network Security Administrator/Specialist

Figure 4-6. IDA Pro startup configuration for test.exe
CODE XREF, which stands for cross-reference. In our case, there are two addresses
in this program that call this subroutine; they are sub_110E8+28 and sub_110E8+40.
While these addresses may appear a bit cryptic, they are easy to understand. In short,
the cross-reference sub_110E8+28 tells you that this LoadStringW subroutine was
called by another subroutine that is located at address 110E8 in the program. The
actual call to LoadStringW was made at the base 110E8 address plus 28 (hex) bits of
memory into the routine.
Not all XREFs are always visible. If there are more than two, there will
be a “...” after the second reference.
While it is possible to scroll up to this memory location, IDA makes it easy by allowing us to click on the reference. Here’s the secret: right-click on the “...” and select
the “Jump to cross reference” option. Select the third option on the list, which
should be 1135C. Without this shortcut, you would have to go to each XREF and
check to see where in the display process the code is.
Practical CE Reverse Engineering |
This is the Title of the Book, eMatter Edition
Copyright © 2007 O’Reilly & Associates, Inc. All rights reserved.
139