IDA can only display functions in graph mode, so in order to see that code as a graph, you must:
Find the start of the function
Search for a prologue, such as push ebp
, mov ebp, esp
1, and find the start of the function. If it gets hard, you can always load debug symbols2 and find the start like that.
1: Actually, most Microsoft DLLs are compiled with the hotpatch option, which means that the prologue is prefixed with mov edi, edi
(here's why), so searching for that instruction should be very easy.
2: In the WinDbg command line, write .symfix
to fix the symbols path and .reload /f mshtml.dll
to reload the symbols for that module. Alternatively, go to Debugger
-> Debugger windows
-> Modules list
, find mshtml.dll
in the window, right-click it and choose "Load debug symbols". Then, simply use the Functions
window or the status bar to find the start of the function.
Make it a function
Put the cursor at the start, and press P. Now press Space and you'll be in graph mode!