8

I got a function whose control flow is kinda screwed... like this:

enter image description here

As you can see, the basic blocks at the top left aren't connected to anything; however, if I check the text disasm, this is what I see:

enter image description here

As you can see, IDA believes that the call doesn't ever return, puts the discontinued line there, and the control flow gets broken (as the next basic block doesn't have a parent).

Is there any way I can manually link the basic blocks, or better, make IDA stop believing that the call doesn't return?

EDIT: The function does return, and doesn't break the rest of places it's used:

enter image description here

Improve this question
3
  • Could you give trying to reanalyze program a go? That's at options -> General -> Analysis -> reanalyze program
    – NirIzr
    Commented Sep 9, 2016 at 11:46
  • have you figured this out?
    – Krypton
    Commented May 13, 2019 at 9:19
  • @Krypton haven't done it myself but I heard it can be done with the cpp SDK
    – rev
    Commented May 13, 2019 at 9:33

4 Answers 4

Reset to default
2

The following picture shows a similar case (Ida V6.3):

enter image description here

with the corresponding useless graph view: enter image description here

Obviously, Ida is completely disturbed. What worked for me in this case, was the following simple procedure:

  1. Undefine Function and code => Ida will show the byte code only
  2. Select the whole undefined area and re-define as code ("C"-key)
  3. Re-define as function.

Thre resulting graph view now looks decent: enter image description here

This helped here, it might however not be a remedy in all similar cases.

Remark: In this particular case, undefining and re-defining the function without undefining the code as well did NOT work.

Improve this answer
1

It is possible to define a function as "return" or "no return".

To do it you should find your called function, right click on it, choose "edit function" and unmark "Does not return" checkbox.

Improve this answer
6
  • Sorry, I forgot to add that, but the function isn't marked as 'Does not return'. I edited the post btw
    – rev
    Commented Aug 29, 2015 at 14:31
  • May be it is one of functions which is called by your not returning function ?
    – w s
    Commented Aug 29, 2015 at 14:36
  • But the function does return, it's just a printf like function which returns a pointer to a formatted string instead of printing it to stdout, so I'm really sure it can't be that it's 'not returning'
    – rev
    Commented Aug 29, 2015 at 14:38
  • I'd be glad to see a binary if possible. It is really strange.
    – w s
    Commented Aug 29, 2015 at 14:53
  • BTW, do you get something interesting if you patch this call with nops ?
    – w s
    Commented Aug 29, 2015 at 15:07
1

Uhm... you could do the other way around. Try this: in the address of the basic block that should be connected from that call statement you say, press Alt+F11 (change callee) and put the address where the call statement is.

Improve this answer
0

You can try to set the type of function va(using hotkey Y). Then if that has no effect, you can try to undefine the function, and re-define that func to force IDA re-analyse.

If you have HexRays decompiler, you can call the decompiler in this function and then click into function va, and then return to the original function.

Those above are tricks for IDA to force the analysis to be launched. I have testeds them on binaries of different CTFs. And in most siturations they worked.

P.S.:Sorry for my poor English

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.