Reverse Engineering Stack Exchange is a question and answer site for researchers and developers who explore the principles of a system through analysis of its structure, function, and operation. It only takes a minute to sign up.
Sign up to join this community
While debugging inside a loaded exe process (using IDA Pro as a disassembler, and WinDbg as a debugger) I can right click the code view and select Graph view:
That will switch it to this nice code-flow view that is much easier to read:
But if I step into a system DLL (in this case mshtml.dll) I can't seem to get that same Graph view command, and instead I get this generic view:
So I was wondering, if there's a way to enable Graph view for a system DLL as well?
IDA can only display functions in graph mode, so in order to see that code as a graph, you must:
Search for a prologue, such as push ebp, mov ebp, esp1, and find the start of the function. If it gets hard, you can always load debug symbols2 and find the start like that.
1: Actually, most Microsoft DLLs are compiled with the hotpatch option, which means that the prologue is prefixed with mov edi, edi (here's why), so searching for that instruction should be very easy.
2: In the WinDbg command line, write .symfix to fix the symbols path and .reload /f mshtml.dll to reload the symbols for that module. Alternatively, go to Debugger -> Debugger windows -> Modules list, find mshtml.dll in the window, right-click it and choose "Load debug symbols". Then, simply use the Functions window or the status bar to find the start of the function.
Put the cursor at the start, and press P. Now press Space and you'll be in graph mode!
Ida Pro some time before "Graph view" option becomes available, i.e. it evidently needs to scan the module after symbols are loaded. After that it will work just fine!