Learning Malware Analysis

2.3.7 Listing All Cross-References

Cross-references are very useful when analyzing malicious binary. During analysis, if you come across a string or a useful function and if you would like to know how they are used in the code, then you can use cross-references to quickly navigate to the location where the string or function is referenced. Cross-reference comments added by IDA are a great way to navigate between addresses, but there is a display limit (of two entries); as a result, you will not be able to see all of the cross-references. Consider the following data cross-reference at ➊; the ellipsis (...) indicates that there are more cross-references:

.data:00403374 dword_403374      dd ?          ; DATA XREF: _main+6w .data:00403374 ; _main+17r ... ➊ ...