11

I have loaded a raw binary (ARM firmware image) into Hopper, and manually marked the entry point as code. But now I'd like to have Hopper do auto-analysis (recursive traversal) starting from that code region, and I can't figure out how to get it to do that (the way it would if I'd loaded a standard PE or elf binary). I can use "Disassemble whole segment", but that seems to do a linear sweep of the entire (30M) binary, which results in a lot of garbage.

Is there any way to do this?

Improve this question
3
  • 8
    Thanks for the input, but IDA isn't mentioned anywhere in my question. Recursive disassembly is clearly something Hopper is capable of, I'm just asking how to trigger it. Do you have some source or reference that says that it can't be done?
    – Brendan Dolan-Gavitt
    Commented Jun 28, 2013 at 17:07
  • I tried with the latest demo version with an ELF binary: pressing C to make code doesn't make code for all the jumps and calls. Pressing 'P' creates a procedure for the function at cursor but doesn't do anything for the functions referenced from that function. So, while recursive disassembly is supported by Hopper it fails to do so properly in current versions.
    – joxeankoret
    Commented Jun 30, 2013 at 11:56
  • I haven't run into this with Hopper, but I do use IDA far more. Does the Scripts -> Mark All Procedures make any difference for you?
    – David Hoelzer
    Commented Jul 13, 2013 at 2:11

1 Answer 1

Reset to default
1

You can mark your entrypoint as unexplored (U) and then mark it as code (C) your segment: Hopper will re-analyse it, as code.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.