0

When analysing mach-o binaries IDA seems to interpret const/literal part of x86 mov instruction(0x8B) as an offset.

Hex rerpresentation: 8B 40 0A

Correct assembly: mov eax,DWORD PTR [eax+0x0A] ; 8B 40 0A

IDA assembly:mov eax, dword ptr ds:(loc_1DF4B8 + 3 - 1DF4B1h)[eax]

loc_1DF4B8 + 3 - 1DF4B1 = 0x0A so its basicaly the same but the offset part throws of further analysis on the binary.

Is there any option i'm missing to prevent this from happening or any scriptable way to fix it?

EDIT: individual instructions can be fixed with s # shortcut

0

it seems this is due to the heuristic applied by IDA. Could you tell us how eax is initialized? Regarding your issue, and if IDA is wrong every times, I think your answer is on the IDA options: here

But I didn't test it.

  • Yes its definitely something with heuristics but i don't think those are exposed in options (maybe it has something to with the fact the base address is 0?). Wrote a script to "fix up" function: hastebin.com/isezikecuh.py Just not so sure that is the proper way to fix this. EDIT: it doesn't really matter where value comes from, it can be a static variable or a something allocated on the heap. However in this example eax is argument passed on stack that points to begining of malloc-ed byte array containg network data. – silvermoon Jan 2 at 23:10

This site is temporarily in read only mode and not accepting new answers.

Not the answer you're looking for? Browse other questions tagged .