2

I am trying to reverse an ELF (C++) binary using IDA v6.95. Decompiler complains that the call analysis is failing. I am attaching the IDB database. What can I do to fix the IDB?

2 Answers 2

2

Call analysis failed at: 08048B19

The instruction at that location:

call __ZNSaIcEC1Ev ; std::allocator<char>::allocator(void)

Now decompile this function:

int __stdcall std::allocator<char>::allocator(int a1, int a2, int a3, int a4, int a5, int a6, int a7, int a8) {
    return std::allocator<char>::allocator(a1, a2, a3, a4, a5, a6, a7, a8);
}

Notice that hexrays has the function signature wrong, it expects too many arguments. After changing it to:

void __stdcall std__allocator_char___allocator()

The main functon will decompile.

Note that hexrays doesn't accept the template arguments <char> and namespace specifier std:: in a function prototype. Since changing the prototype does not rename the function you can replace the function name with any name, as long as ida considers it valid.

2
  • Doesn't work for me. Can you please share your IDB? Jun 6, 2017 at 4:11
  • ah, i made a typo: the function signature should be: void __stdcall std__allocator_char___allocator() without the < and > Jun 6, 2017 at 6:39
0

the IDB database can not open now.

list my case for other refer:

Error case

in IDA:

  • caller: some_parent_function
    • callee: sub_9D6B278

in some_parent_function, do F5=decompile, report error:

Decompilation failure: 9D6ADDC: call analysis failed

enter image description here

Error Reason

  • call analysis failed

    the decompiler could not determine the calling convention and the call parameters.

->

  • = decompiled function's parameter number is wrong
    • = (probably) decompiled function have too many parameters

->

  • here sub_9D6B278's decompiled function have too many parameters, which seems is wrong

sub_9D6B278 decompiled pseudocode

void __usercall sub_9D6B278(__int64 a1, __int64 a2, __int64 a3, __int64 a4, __int64 a5, __int64 a6, __int64 a7, __int64 a8, __int64 a9, __int64 a10, ...)
{
  va_list va; // [xsp+50h] [xbp+50h]

  va_start(va, a10);
  _Block_object_dispose(va, 8);
}

Solution

  • call analysis failed

    If this is a direct non-variadic call, you can fix it by specifying the callee type: just jump to the callee and hit Y to specify the type.

    For variadic functions too it is a good idea to specify the type, but the call analysis could still fail because the decompiler has to find out the actual number of arguments in the call.

means:

  • change decompiled function's type/definition
    • == change function to correct number of parameters

how to know what is the correct number of parameters?

you should look inside the error callee function assembly code

try to understand it real used parameters (and better to understand it internal logic)

here related assembly code is:

sub_9D6B278 disassembly code

__text:0000000009D6B278 ; =============== S U B R O U T I N E =======================================
__text:0000000009D6B278
__text:0000000009D6B278
__text:0000000009D6B278 ; __int64 __fastcall sub_9D6B278(int, char)
__text:0000000009D6B278 sub_9D6B278       ; CODE XREF: -[NSObject bdp_addObserverForKeyPaths:identifier:options:context:task:]+1D8↑p
__text:0000000009D6B278                                         ; __text:0000000009D6AF04↑p
__text:0000000009D6B278
__text:0000000009D6B278 arg_50          =  0x50
__text:0000000009D6B278
__text:0000000009D6B278                 ADD             X0, SP, #arg_50 ; void *
__text:0000000009D6B27C                 MOV             W1, #8  ; int
__text:0000000009D6B280                 B               __Block_object_dispose
__text:0000000009D6B280 ; End of function sub_9D6B278

and can figure out: only two real parameter

how to edit/change function type/definition ?

so here change function to correct two parameters:

cursor selected function name -> right click -> Set Type (Y)

enter image description here

change from (too many, wrong number of parameter) :

  • __int64 __fastcall sub_9D6B278(int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, char)
    • enter image description here

to (correct number of parameter):

  • __int64 __fastcall sub_9D6B278(int, char)
    • enter image description here
    • enter image description here

then decompiled is OK:

enter image description here

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.