No DATA XREF when reversing WoW Mac client API [17128]

[jamesbay]

Hi,

I am reversing some functions from the WoW API on the Mac client, however, IDA 6.1 finds no DATA XREF as I can find in the Windows client, see images below.

Anyone who can explain me how come it does not find any XREF in the WoW Mac client as it does with the Windows counterpart?

WoW Windows client


WoW Mac client

[TOM_RUS]

Create them manually? They are here, but IDA didn't recognize them.

[jamesbay]

Create them manually? They are here, but IDA didn't recognize them.

I have not tried that before, but made a quick search on the topic on stackexchange to get the idea. But how would I actually go about finding where it should be referencing?

[_Mike]

Look at calls to FrameScript_RegisterFunction.

[TOM_RUS]

Look at calls to FrameScript_RegisterFunction.

Or use dumb way. Say you have found this:

__cstring:013127CB 47 65 74 5A 6F 6E 65 54 65 78+aGetzonetext    db 'GetZoneText',0

Take 013127CB, split into bytes: 01 31 27 CB, reverse: CB 27 31 01, Alt+B, put that into textbox and click ok, you should get list of occurrences, double click one from __const section, press "O", move cursor to next line, press "O" again...

[jamesbay]

Or use dumb way. Say you have found this:

__cstring:013127CB 47 65 74 5A 6F 6E 65 54 65 78+aGetzonetext    db 'GetZoneText',0

Take 013127CB, split into bytes: 01 31 27 CB, reverse: CB 27 31 01, Alt+B, put that into textbox and click ok, you should get list of occurrences, double click one from __const section, press "O", move cursor to next line, press "O" again...

You sir! are brilliant. Had no idea that would be so straightforward. It only found one occurrence, which it made the XREF for. Have now found the sub and so forth. Thank you once again.

+rep

[MaiN]

Or use dumb way. Say you have found this:

__cstring:013127CB 47 65 74 5A 6F 6E 65 54 65 78+aGetzonetext    db 'GetZoneText',0

Take 013127CB, split into bytes: 01 31 27 CB, reverse: CB 27 31 01, Alt+B, put that into textbox and click ok, you should get list of occurrences, double click one from __const section, press "O", move cursor to next line, press "O" again...

You don't have to manually split the bytes, you can search for 0x013127CB and IDA will treat it as a little endian 4-byte value.
I do find it very annoying though, that IDA is not recognizing these obvious xrefs. Perhaps ExtraPass works, although I haven't tried.

[TOM_RUS]

You don't have to manually split the bytes, you can search for 0x013127CB and IDA will treat it as a little endian 4-byte value.

Nice, never tried that. Thought it only searches for bytes.

[MaiN]

Nice, never tried that. Thought it only searches for bytes.

Yeah, it also works for strings, if you for some reason need to search for those without using the strings window.