8

I got a function whose control flow is kinda screwed... like this:

enter image description here

As you can see, the basic blocks at the top left aren't connected to anything; however, if I check the text disasm, this is what I see:

enter image description here

As you can see, IDA believes that the call doesn't ever return, puts the discontinued line there, and the control flow gets broken (as the next basic block doesn't have a parent).

Is there any way I can manually link the basic blocks, or better, make IDA stop believing that the call doesn't return?

EDIT: The function does return, and doesn't break the rest of places it's used:

enter image description here

  • Could you give trying to reanalyze program a go? That's at options -> General -> Analysis -> reanalyze program – NirIzr Sep 9 '16 at 11:46
  • have you figured this out? – Krypton May 13 '19 at 9:19
  • @Krypton haven't done it myself but I heard it can be done with the cpp SDK – rev May 13 '19 at 9:33
2

The following picture shows a similar case (Ida V6.3):

enter image description here

with the corresponding useless graph view: enter image description here

Obviously, Ida is completely disturbed. What worked for me in this case, was the following simple procedure:

  1. Undefine Function and code => Ida will show the byte code only
  2. Select the whole undefined area and re-define as code ("C"-key)
  3. Re-define as function.

Thre resulting graph view now looks decent: enter image description here

This helped here, it might however not be a remedy in all similar cases.

Remark: In this particular case, undefining and re-defining the function without undefining the code as well did NOT work.

1

It is possible to define a function as "return" or "no return".

To do it you should find your called function, right click on it, choose "edit function" and unmark "Does not return" checkbox.

  • Sorry, I forgot to add that, but the function isn't marked as 'Does not return'. I edited the post btw – rev Aug 29 '15 at 14:31
  • May be it is one of functions which is called by your not returning function ? – w s Aug 29 '15 at 14:36
  • But the function does return, it's just a printf like function which returns a pointer to a formatted string instead of printing it to stdout, so I'm really sure it can't be that it's 'not returning' – rev Aug 29 '15 at 14:38
  • I'd be glad to see a binary if possible. It is really strange. – w s Aug 29 '15 at 14:53
  • BTW, do you get something interesting if you patch this call with nops ? – w s Aug 29 '15 at 15:07
1

Uhm... you could do the other way around. Try this: in the address of the basic block that should be connected from that call statement you say, press Alt+F11 (change callee) and put the address where the call statement is.

0

You can try to set the type of function va(using hotkey Y). Then if that has no effect, you can try to undefine the function, and re-define that func to force IDA re-analyse.

If you have HexRays decompiler, you can call the decompiler in this function and then click into function va, and then return to the original function.

Those above are tricks for IDA to force the analysis to be launched. I have testeds them on binaries of different CTFs. And in most siturations they worked.

P.S.:Sorry for my poor English

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.