Learning Malware Analysis

5.2.2 Code Cross-References to CreateFile Using IDAPython

Having identified the reference to the CreateFileA function, let's try to identify cross-references to (Xrefs to) the CreateFileA function; this will give us all the addresses where CreateFileA is called from. The following script builds on the previous script and identifies the cross-references to the CreateFileA function:

import idcimport idautilsea = idc.get_name_ea_simple("CreateFileA")if ea != idaapi.BADADDR:    for ref in idautils.CodeRefsTo(ea, 1):        print hex(ref), idc.generate_disasm_line(ref,0)

The following is the output generated as a result of running the preceding script. The output displays all of the instructions that call the CreateFileA API function:

0x401161 call ds:CreateFileA ...