1

When analysing mach-o binaries IDA seems to interpret const/literal part of x86 mov instruction(0x8B) as an offset.

Hex rerpresentation: 8B 40 0A

Correct assembly: mov eax,DWORD PTR [eax+0x0A] ; 8B 40 0A

IDA assembly:mov eax, dword ptr ds:(loc_1DF4B8 + 3 - 1DF4B1h)[eax]

loc_1DF4B8 + 3 - 1DF4B1 = 0x0A so its basicaly the same but the offset part throws of further analysis on the binary.

Is there any option i'm missing to prevent this from happening or any scriptable way to fix it?

EDIT: individual instructions can be fixed with s # shortcut

Improve this question

1 Answer 1

Reset to default
1

it seems this is due to the heuristic applied by IDA. Could you tell us how eax is initialized? Regarding your issue, and if IDA is wrong every times, I think your answer is on the IDA options: here

But I didn't test it.

Improve this answer
1
  • Yes its definitely something with heuristics but i don't think those are exposed in options (maybe it has something to with the fact the base address is 0?). Wrote a script to "fix up" function: hastebin.com/isezikecuh.py Just not so sure that is the proper way to fix this. EDIT: it doesn't really matter where value comes from, it can be a static variable or a something allocated on the heap. However in this example eax is argument passed on stack that points to begining of malloc-ed byte array containg network data.
    – silvermoon
    Commented Jan 2, 2019 at 23:10

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.