Currently I am analyzing a .so file and there is a function which is supposed to be large (high number of nodes and edges). However, IDA Pro identified it as a small function, with various parts of the code being treated as individual sub routines and some of them have attributes of "no return".

I tried to use append_func_tail to combine the sub routines together but the function returns false.

I am trying to do these

  • Combine the various sub routines together into one main sub routine
  • Calculate the cyclomatic complexity value of this big sub routine

Is there a way to do the above?

  • Hi and welcome to RE.SE! Can you provide an ida database of binary containing the function in question? – Nordwald Jan 31 '19 at 10:47
  • If these function fragments are placed sequentially, manual fix is possible. Delete all the functions that IDA created instead of function fragments (AFAIR, Edit-->Functions-->Delete function). Select all the instructions that should be in the large function, and press P. This should create a large function from the selected instructions. – w s Jan 31 '19 at 13:42
  • unfortunately, I cannot share the database because the file is proprietary and I am not allowed to share it. I see some suggestions below to try out, will try them. – localacct Feb 7 '19 at 2:47
  • I would like to add that the functions are not located sequentially but "scattered" throughout – localacct Feb 7 '19 at 2:53

If IDA has erroneously marked functions as "noreturn", you can manually edit this with Alt-P. "Does not return" is a checkmark that you can select. Once you've removed this attribute, IDA should properly disassemble the code following the function call -- though you may need to delete functions (as the comment said) if IDA is using obsolete information about the function boundaries.

  • Rerunning IDA's autoanalysis (Options->General->Analysis->Reanalyze program) will fix/adjust most of the incorrectly analyzed functions. That's worth trying before manually deleting functions. – NirIzr Feb 4 '19 at 12:29
  • hey folks! Thanks for the reply, will try the suggestions. – localacct Feb 7 '19 at 2:46
  • Hi folks, I unchecked the "no return" attribute, deleted the sub routines and ran analysis again but IDA Pro just identify those sub routines as individual sub routines as per its original analysis. I was not able to manually highlight the code portions and indicate them as one big function as they were not located sequentially. Anything else I can try? – localacct Feb 7 '19 at 3:10

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.