0

I was wondering if anyone could help me and explain how I should process a graph that looks like this in IDA Pro, where the right most node is the entrypoint, and it contains several of these small function chunks to its left. does it mean that function has multiple entry points? (the cross-references from the noes seem to indicate that). How is this translated into a high level language? (pseudocode). IDA graph

1

It may be a result of unrecognized or misunderstood switch/case. Please post all the assembly code of the function - this will probably help to locate it.

  • Hi, you can find the relevant code in a 64bit ntdll on Windows 7 SP1 x64 fully patched. It is the function tppWorkerThread() if you still need me to paste the assembly somewhere I could post it in a gist. Thanks. – gandolf Jul 18 '17 at 12:03
  • Post a gist, please. – w s Jul 18 '17 at 12:10
  • Ok, this might take a while because the function chunks (in text view) span across several addresses and other functions. It's worst than I thought to just extract because they are not in sequential order in plain disassembly view. I may have to insist one opens up that ntdll themselves to see for themselves, but i'll see what I can do to present the relevant assembly. – gandolf Jul 18 '17 at 12:33
  • I found this function occasionally, and it looks completely different. Which IDA version are you working with ? – w s Jul 30 '17 at 12:39
0

Try right-clicking and then clicking on layout graph. That should fix things up, if you dont see it try moving one the windows. And it should pop up. I know this is a comment-type answer, but I cannot comment.

  • @gandolf ahh, sorry then :) – Verideth Jul 18 '17 at 12:11

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.