I have to write an
IDAPython script and I came across many false positives in IDA's function/code/data recognition.
Case 1 - Invalid function's end (rpcrt4.dll):
In some DLLs (especially in rpcrt4.dll) IDA recognize indirect/dereference calls as function's end and then misidentifies the next instructions (IDA's
no-return kernel analysis flag is of course disabled so it is not the problem).
Example (the unknown data is a valid
Case 2 - Data in
.text section is identified as code (ExplorerFrame.dll):
Most of Microsoft's DLLs are compiled with data at the beginning of the
.text section and IDA successfully identifies it as data. However, sometimes IDA fail to treat these
heads as data and treats them like code (my guess is that it has something to do with the misidentified
Case 3 - code inside a function is identified as data (mimeTools.dll):
This case is a little bit weird because I don't see any reason to make this mistake. As you can clearly see IDA identifies code as data inside the function (the misidentified code is a lea instruction).
Case 4 - mixed misidentified code (igc32.dll):
No need to elaborate, in the following example it should be all code but it gets identified as data:
And another example:
So obviously my question is: did anyone experience one of these problem's before and know a possible fix to some of these problems? I need a solution that don't involve human interaction and can be applied using an IDAPython script.
Thanks in advance.