3

I have the following IDA output:

BEGTEXT:00415A2C read_dpc_sub_415928 endp
BEGTEXT:00415A2C
BEGTEXT:00415A2C ; ---------------------------------------------------------------------------
BEGTEXT:00415A2D                 align 10h
BEGTEXT:00415A30                 push    ebx
BEGTEXT:00415A31                 push    edx
BEGTEXT:00415A32                 mov     edx, eax
BEGTEXT:00415A34                 call    sub_41576C
BEGTEXT:00415A39                 mov     ebx, eax
BEGTEXT:00415A3B                 call    sub_415758
BEGTEXT:00415A40                 mov     eax, ebx
BEGTEXT:00415A42                 call    sub_4158C8
BEGTEXT:00415A47                 mov     eax, ebx
BEGTEXT:00415A49                 pop     edx
BEGTEXT:00415A4A                 pop     ebx
BEGTEXT:00415A4B                 retn
BEGTEXT:00415A4B ; ---------------------------------------------------------------------------

As you can see, IDA has considered that this is a code block but it hasn't been made a function.

Can you explain how one should try handle this situation ?

i.e. is this really code in the end and what to consider when making a function.

(if that matters, the executable is a 32-bit Windows one)

6

You can make it a function by placing a cursor to address 00415A2C in disassembly view and pressing P. If this doesn't work you can select the whole function and, again, press P. The documentation on this action is located here. If all this doesn't work, undefine align 10h by pressing U, make resulting bytes code by pressing C and try again.

There are a lot of reasons why this function has not been created automatically, including, but not limited by:

  • This function is not called directly
  • This function is not called at all
  • IDA autoanalysis was unable to find a reference to this function as function
3
  • I will assume that IDA is right for the time being, then I will eventually dig deeper with the first two reasons you've written, thanks!
    – aybe
    May 7 '19 at 16:50
  • Why undefining the align may solve the issue?
    – Biswapriyo
    May 7 '19 at 18:30
  • I think that I remember something like this on older IDA versions: align was not recognized as instruction and thus the function couldn't be created. I really don't remember in which architecture and in which version I had seen it.
    – w s
    May 7 '19 at 19:14

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.