1

Currently I am analyzing a .so file and there is a function which is supposed to be large (high number of nodes and edges). However, IDA Pro identified it as a small function, with various parts of the code being treated as individual sub routines and some of them have attributes of "no return".

I tried to use append_func_tail to combine the sub routines together but the function returns false.

I am trying to do these

  • Combine the various sub routines together into one main sub routine
  • Calculate the cyclomatic complexity value of this big sub routine

Is there a way to do the above?

Improve this question
4
  • Hi and welcome to RE.SE! Can you provide an ida database of binary containing the function in question?
    – Nordwald
    Jan 31, 2019 at 10:47
  • If these function fragments are placed sequentially, manual fix is possible. Delete all the functions that IDA created instead of function fragments (AFAIR, Edit-->Functions-->Delete function). Select all the instructions that should be in the large function, and press P. This should create a large function from the selected instructions.
    – w s
    Jan 31, 2019 at 13:42
  • unfortunately, I cannot share the database because the file is proprietary and I am not allowed to share it. I see some suggestions below to try out, will try them.
    – localacct
    Feb 7, 2019 at 2:47
  • I would like to add that the functions are not located sequentially but "scattered" throughout
    – localacct
    Feb 7, 2019 at 2:53

1 Answer 1

Reset to default
1

If IDA has erroneously marked functions as "noreturn", you can manually edit this with Alt-P. "Does not return" is a checkmark that you can select. Once you've removed this attribute, IDA should properly disassemble the code following the function call -- though you may need to delete functions (as the comment said) if IDA is using obsolete information about the function boundaries.

Improve this answer
3
  • Rerunning IDA's autoanalysis (Options->General->Analysis->Reanalyze program) will fix/adjust most of the incorrectly analyzed functions. That's worth trying before manually deleting functions.
    – NirIzr
    Feb 4, 2019 at 12:29
  • hey folks! Thanks for the reply, will try the suggestions.
    – localacct
    Feb 7, 2019 at 2:46
  • Hi folks, I unchecked the "no return" attribute, deleted the sub routines and ran analysis again but IDA Pro just identify those sub routines as individual sub routines as per its original analysis. I was not able to manually highlight the code portions and indicate them as one big function as they were not located sequentially. Anything else I can try?
    – localacct
    Feb 7, 2019 at 3:10

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.