1

I took the following C code and compiled it on Ubuntu 16.04 with GCC 5.4.0:

int main() {
  int a = 0;
  for (int i = 0; i < 5; i++) {
    switch (i) {
      case 0:
        a = 1;
        break;
      case 1:
        a = 2;
        break;
      case 2:
        a = 3;
        break;
      case 3:
        a = 4;
        break;
      case 4:
        a = 5;
        break;
      default:
        a = 6;
        break;
    }
  }
}

I compiled this as a PIE binary with this command: gcc -pie -fPIE test.c. You can see the disassembly in IDA 6.95 below:

disassembly

Note that IDA was not able to identify the switch statement. Because I compiled this as PIE, the table located at 0x824 does not contain the absolute addresses to jump to, but the signed relative offsets:

.rodata:0000000000000824 ; signed int dword_824[5]
.rodata:0000000000000824 dword_824       dd 0FFFFFF2Ah, 0FFFFFF33h, 0FFFFFF3Ch, 0FFFFFF45h, 0FFFFFF4Eh

I've tried to specify that this is a switch statement by going to Edit -> Other -> Specify Switch Idiom, but IDA still isn't able to figure it out. For example, this is one set of values I tried:

I tried a couple different permutations of configuration options here, but I couldn't get anything to work. What exactly do I need to do to teach IDA about this switch statement?

0

1 Answer 1

3

I figured it out. Here's how the configuration should look, the important things are setting "element base value" to the offset of the jump table and checking "Signed jump table elements". Also, if you don't have the "Input register of switch" set to the right register, your graph view will look fine but decompilation will fail with "switch analysis failed".

0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.