4

While debugging inside a loaded exe process (using IDA Pro as a disassembler, and WinDbg as a debugger) I can right click the code view and select Graph view:

enter image description here

That will switch it to this nice code-flow view that is much easier to read:

enter image description here

But if I step into a system DLL (in this case mshtml.dll) I can't seem to get that same Graph view command, and instead I get this generic view:

enter image description here

So I was wondering, if there's a way to enable Graph view for a system DLL as well?

5

IDA can only display functions in graph mode, so in order to see that code as a graph, you must:

Find the start of the function

Search for a prologue, such as push ebp, mov ebp, esp1, and find the start of the function. If it gets hard, you can always load debug symbols2 and find the start like that.

1: Actually, most Microsoft DLLs are compiled with the hotpatch option, which means that the prologue is prefixed with mov edi, edi (here's why), so searching for that instruction should be very easy.

2: In the WinDbg command line, write .symfix to fix the symbols path and .reload /f mshtml.dll to reload the symbols for that module. Alternatively, go to Debugger -> Debugger windows -> Modules list, find mshtml.dll in the window, right-click it and choose "Load debug symbols". Then, simply use the Functions window or the status bar to find the start of the function.

Make it a function

Put the cursor at the start, and press P. Now press Space and you'll be in graph mode!

  • Thanks for the info. What I didn't realize is that it takes Ida Pro some time before "Graph view" option becomes available, i.e. it evidently needs to scan the module after symbols are loaded. After that it will work just fine! – c00000fd Jan 1 '17 at 3:57

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.