I know that red addresses means, that code do not recognize as a function in IDA, because that code never get called. But I have found a piece of code that is marked red, but when debugging, I saw that this code gets called. But I still can't get that graph view of that piece of code and it still marked red. Can someone please explain what's happening here..?
Add a comment
|
1 Answer
To make IDA recognize the code as a procedure, press P at the start of it.
Ida "automatically presses the P key" if it sees a direct call to that address. However, if the source code was C++ or another language with classes, the function might never be called directly, only indirectly through the vtable (table of method start addresses) of the class. In this case, you'll have to mark the procedure manually.
answered Jul 21, 2015 at 11:58
-
Can you explain or give a reference to look at, how to mark the procedure manually..?– Ramesh-XCommented Jul 21, 2015 at 12:02
-
1Not sure if I understand your question - put the cursor at the start of the red area, and press the P key, just like i said in my answer. Commented Jul 21, 2015 at 12:06