10

I have loaded a raw binary (ARM firmware image) into Hopper, and manually marked the entry point as code. But now I'd like to have Hopper do auto-analysis (recursive traversal) starting from that code region, and I can't figure out how to get it to do that (the way it would if I'd loaded a standard PE or elf binary). I can use "Disassemble whole segment", but that seems to do a linear sweep of the entire (30M) binary, which results in a lot of garbage.

Is there any way to do this?

  • 1
    Hopper is not IDA. Don't expect it to be a cheaper IDA. It isn't. – joxeankoret Jun 28 '13 at 11:59
  • 8
    Thanks for the input, but IDA isn't mentioned anywhere in my question. Recursive disassembly is clearly something Hopper is capable of, I'm just asking how to trigger it. Do you have some source or reference that says that it can't be done? – Brendan Dolan-Gavitt Jun 28 '13 at 17:07
  • I tried with the latest demo version with an ELF binary: pressing C to make code doesn't make code for all the jumps and calls. Pressing 'P' creates a procedure for the function at cursor but doesn't do anything for the functions referenced from that function. So, while recursive disassembly is supported by Hopper it fails to do so properly in current versions. – joxeankoret Jun 30 '13 at 11:56
  • I haven't run into this with Hopper, but I do use IDA far more. Does the Scripts -> Mark All Procedures make any difference for you? – David Hoelzer Jul 13 '13 at 2:11
1

You can mark your entrypoint as unexplored (U) and then mark it as code (C) your segment: Hopper will re-analyse it, as code.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.