0

have using IDA Pro 6.8 (Hex-Rays 2.2), default settings.

Problem starts happens when i trying to analyze function (which actual size ~2886 bytes), pressing F5 (without errors or alerts) and getting in output only first few code blocks:

Hex-Rays output

But actual code much bigger than result, why Hex-Rays skip all other code and how to fix it?

0

As I know it's a default hex rays behavior. If it can't decompile something, it will just skip it. In your case it looks like it failed to analyze stack. Same thing was in IDA 7.0, and even in 7.2. What's the situation in further IDA versions I don't know.

  • Wrong. "If it can't decompile something", it will ether refuse to decompile the function altogether or produce an __asm block. This case is likely dead code elimination. – Igor Skochinsky Nov 7 at 14:01
  • Yep I know that it all works at your side :) But had a lot of pain while reversing ARM code, where the decompiler just skipped the blocks of the code, without any reason. Most often it lost the if statements, and some of the cases of switch constructions. – Anton Kukoba Nov 8 at 9:26
0

You need to fix the disassembly. For example, this is a call to a location which is not a proper function:

call    loc_11B4460

And this call does not return, so all code after it is removed as dead code by the decompiler:

.text:00CA5E6B   call    sub_4E5CE9

You can see it by the dashed line added by IDA after the call (these lines are added to show breaks in code flow. You can also probably see the break in the code flow in the graph view as well.

You can remove the no-return flag from the target function by editing its properties, and for the first call you need to check why IDA could not create a function at loc_11B4460 and fix it.

The decompiler relies on IDA for the disassembly, so if your disassembly is bad you’ll get bad decompilation (aka garbage in-garbage out).

Check also the FAQ for some of the other common problems.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.