I took the following C code and compiled it on Ubuntu 16.04 with GCC 5.4.0:
int main() {
int a = 0;
for (int i = 0; i < 5; i++) {
switch (i) {
case 0:
a = 1;
break;
case 1:
a = 2;
break;
case 2:
a = 3;
break;
case 3:
a = 4;
break;
case 4:
a = 5;
break;
default:
a = 6;
break;
}
}
}
I compiled this as a PIE binary with this command: gcc -pie -fPIE test.c
. You can see the disassembly in IDA 6.95 below:
Note that IDA was not able to identify the switch statement. Because I compiled this as PIE, the table located at 0x824 does not contain the absolute addresses to jump to, but the signed relative offsets:
.rodata:0000000000000824 ; signed int dword_824[5]
.rodata:0000000000000824 dword_824 dd 0FFFFFF2Ah, 0FFFFFF33h, 0FFFFFF3Ch, 0FFFFFF45h, 0FFFFFF4Eh
I've tried to specify that this is a switch statement by going to Edit -> Other -> Specify Switch Idiom
, but IDA still isn't able to figure it out. For example, this is one set of values I tried:
I tried a couple different permutations of configuration options here, but I couldn't get anything to work. What exactly do I need to do to teach IDA about this switch statement?