NefMoto

In the firmware disassembled in IDA Pro, there are functions for which there are no xrefs, as in the example below. Firmware HJ 0002. How to determine where such functions are called from?

These are from indirect calls / calls by function pointer. The actual call is by a 3 op procedure:


Before this is called there is typically a read of a function pointer from a larger array or some other structure to put the segment and offset of the function to r4/r5. In my disassembly I tried to do it completely right and bind all such structures to their call sites, I managed 99%, but this is a very tedious task. 

How can "push r4, push r5, rets"  invoke a function? I can not find such addressing in the datasheet ...

rets means return according to items on the stack. So push stuff on the stack, call rets, and its the same as a call, except when that routine rets, it returns to the caller of the original function.

Find that thing, make a subfunction out of it and you will find a lot of calls to it like here:



This is also often used to look up functions from a function pointer table with an index and then call them.

I've not been able to find where these sometimes long arrays are referenced from. From what I understand you know from where and how?