Multiple decompilation failure with ntoskrnl

Question

IDA v7 shows decompilation failure in 64bit ntoskrnl.exe file of Windows 10 build 18262. Here is an example of that:

I've loaded all the needed type libraries, PDB file, kernel mode header files (wdm.h, ntddk.h, ntdef.h etc.). But it doesn't change anything with that errors. The assembly is simple to translate. I found the error may be related to END OF FUNCTION CHUNK FOR NtQueryInformationProcess comment. Here is the example assembly in ntoskrnl.exe PAGE segment where IDA shows that warning:

lea     rdx, cs:140000000h
mov     eax, ds:(off_1405DF7E4 - 140000000h)[rdx+rbx*4]
add     rax, rdx
jmp     rax         ; failed here 

What can I do to remove this error? If you need any further information I can add that in this question.

Answer 1

As a generic, incomplete answer: switch analysis is a common source of failure in using Hex-Rays (and even IDA). You can fix these errors by manually editing the switch information using Edit->Other->Specify switch idiom with your cursor somewhere near the beginning. However, I can't give you complete instructions on how to do this. My best advice is to search the disassembly listing for the word 'switch' using Alt-T, and use the edit command just mentioned to view the switch information. For each one, copy the information into a text editor, and compare it against the disassembly listing. This will start to give you an idea of what the fields mean. From there, experiment with the failing switch. Does something you learned from the process I just describe seem not to fit well with the information presented for the failing switch? Change it and see what happens.