MIPS Call Analyzer

An IDA Pro 9 plugin that traces register arguments and stack arguments at every call site of a named MIPS function, displaying the results in a sortable table window.

---

Features

• Reconstructs call expressions at every jal/jalr/jr/bal/ba site for a given function
• Reads argument count from type information when available; falls back to a heuristic scan
• Traces up to 4 register args ($a0–$a3) and additional stack-passed args (sw $rN, N($sp))
• Extracts inline string literals from the disassembly when present
• Results shown in a native IDA table window

---

Installation

Copy mips_call_analyzer.py to your IDA plugins directory:

Platform	Path
Linux / macOS	~/.idapro/plugins/
Windows	%APPDATA%\Hex-Rays\IDA Pro\plugins\

---

Usage

Context menu

Right-click on any of the following and choose MIPS Call Analyzer → Analyze MIPS calls to '…':

• A jal, jalr, jr, bal, or ba instruction → analyzes the called function
• A function label or named address → analyzes that name
• Anywhere inside a function body → analyzes the containing function
• A row in the Functions window → analyzes the selected function

Hotkey

Press Alt-Shift-M anywhere in the disassembly to open a name prompt and type a function name manually.

---

Output

Results appear in a window with three columns:

Address	Caller	Reconstructed call
0x00401234	handle_request	calls_system("reboot", 0)
0x00403ab0	run_cmd	calls_system("ls", 1)

double-click any row to jump to the call site