2

I am trying to create a graph so that I can visualize the flow of a particular function in a game that I am interested in. I was initially using Cheat Engine to follow the flow of the function, but after going through about 20 jmps to finally get to the ret instruction, I decided to open up the executable in IDA so that I could see the graph view.

When I opened the executable in IDA, I ran into an issue where the auto-analysis gets "stuck" in a loop, never finishing.

Looking at the code, I do wonder if there is some sort of obfuscation going on, because it seems like the same thing could be coded in a far lesser number of instructions.

What should I do?

Here is an example of a piece of the code that I suspect is causing an issue (sorry if my comments don't make much sense):

cmp [rcx],rdi             ; if *rcx == rdi:
cmove eax,r15d            ; do eax = r15d
add rcx,08                ; rcx += 8
dec rdx                   ; i -= 1
mov [rsp-08],rbp          ; var a = rbp
lea rsp,[rsp-08]          ; rsp = &a
mov rbp,game.exe+13139A0  ; rbp = game.exe+13139A0
xchg [rsp],rbp            ; swap(a, rbp) i.e.
                          ;   a = game.exe+13139A0
                          ;   rbp = rbp (original value)
lea rsp,[rsp-08]          ; var b; rsp = &b
mov [rsp],rbx             ; b = rbx
lea rsp,[rsp-08]          ; var c; rsp = &c
mov [rsp],rax             ; c = rax
mov rbx,[rsp+10]          ; rbx = a
mov rax,game.exe+1313990  ; rax = game.exe+1313990
cmovne rbx,rax            ; rbx = i == 0 ? rax : rbx
mov [rsp+10],rbx          ; a = rbx
lea rsp,[rsp+08]          ; rsp = &b
mov rax,[rsp-08]          ; rax = c
mov rbx,[rsp]             ; rbx = b
lea rsp,[rsp+08]          ; rsp = &a
lea rsp,[rsp+08]          ; rsp = &???
jmp qword ptr [rsp-08]    ; jmp a i.e.
                          ;   i == 0: game.exe+1313990
                          ;   i != 0: game.exe+13139A0
Improve this question
2
  • The code is obfuscated by Arxan GuardIT. If IDA is actually infinitely looping here, that's a bug, which might also affect the 7.x commercial line. If so, Hex-Rays might fix it upstream and could possibly release a new freeware build. But, given that Hex-Rays states on the freeware download page that this version "comes without technical support", they probably won't reply to a support mail. Your best and only option is to hope an IDA developer sees and confirms this, reproduces it in commercial builds, fixes it, and releases a new freeware. I wouldn't hold my breath for a freeware update.
    – Rolf Rolles
    Commented May 23, 2018 at 7:03
  • Which game is it?
    – mrexodia
    Commented May 27, 2018 at 9:50

1 Answer 1

Reset to default
2

Undefining the code piece, which makes autoanalysis stuck, usually helps. You can always return to this part and make it code again after autoanalysis is complete.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.