0

IDA v7 shows decompilation failure in 64bit ntoskrnl.exe file of Windows 10 build 18262. Here is an example of that:

decompilation_faliure

I've loaded all the needed type libraries, PDB file, kernel mode header files (wdm.h, ntddk.h, ntdef.h etc.). But it doesn't change anything with that errors. The assembly is simple to translate. I found the error may be related to END OF FUNCTION CHUNK FOR NtQueryInformationProcess comment. Here is the example assembly in ntoskrnl.exe PAGE segment where IDA shows that warning:

lea     rdx, cs:140000000h
mov     eax, ds:(off_1405DF7E4 - 140000000h)[rdx+rbx*4]
add     rax, rdx
jmp     rax         ; failed here 

What can I do to remove this error? If you need any further information I can add that in this question.

  • Hex-Rays Decompiler is not perfect and bug free. It sometimes fails even on unobfuscated code. Try to use older or newer version of the decompiler. – MazeGen Dec 7 '18 at 22:43
2

As a generic, incomplete answer: switch analysis is a common source of failure in using Hex-Rays (and even IDA). You can fix these errors by manually editing the switch information using Edit->Other->Specify switch idiom with your cursor somewhere near the beginning. However, I can't give you complete instructions on how to do this. My best advice is to search the disassembly listing for the word 'switch' using Alt-T, and use the edit command just mentioned to view the switch information. For each one, copy the information into a text editor, and compare it against the disassembly listing. This will start to give you an idea of what the fields mean. From there, experiment with the failing switch. Does something you learned from the process I just describe seem not to fit well with the information presented for the failing switch? Change it and see what happens.

  • Your trick works. I'm investigating what happens behind-the-scene. – Biswapriyo Feb 3 at 9:40

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.