I was wondering if anyone could help me and explain how I should process a graph that looks like this in IDA Pro, where the right most node is the entrypoint, and it contains several of these small function chunks to its left. does it mean that function has multiple entry points? (the cross-references from the noes seem to indicate that). How is this translated into a high level language?
(pseudocode).
Add a comment
|
2 Answers
It may be a result of unrecognized or misunderstood switch/case. Please post all the assembly code of the function - this will probably help to locate it.
-
Hi, you can find the relevant code in a 64bit ntdll on Windows 7 SP1 x64 fully patched. It is the function
tppWorkerThread()if you still need me to paste the assembly somewhere I could post it in a gist. Thanks.– gandolfJul 18, 2017 at 12:03 -
-
Ok, this might take a while because the function chunks (in text view) span across several addresses and other functions. It's worst than I thought to just extract because they are not in sequential order in plain disassembly view. I may have to insist one opens up that ntdll themselves to see for themselves, but i'll see what I can do to present the relevant assembly.– gandolfJul 18, 2017 at 12:33
-
I found this function occasionally, and it looks completely different. Which IDA version are you working with ?– w sJul 30, 2017 at 12:39
Try right-clicking and then clicking on layout graph. That should fix things up, if you dont see it try moving one the windows. And it should pop up. I know this is a comment-type answer, but I cannot comment.
