Learning Malware Analysis

2.3.6 Cross-References

Another way to navigate is by using cross-references (also referred to as Xrefs). The cross-references link relates addresses together. Cross-references can be either data cross-references or code cross-references.

A data cross-reference specifies how the data is accessed within a binary. An example of a data cross-reference is shown at ➐, ➑, and ➒, in the preceding listing. For example, the data cross-references at ➑ tell us that this data is referenced by the instruction which is at the offset 0x6, from the start of the _main function (in other words, the instruction at ➋). The character w indicates a write cross-reference; this tells us that the instruction writes content into this memory location (note that 29h ...