0

enter image description here

I tried to unpack packed_dll, when the unpack stage done, i dumped unpacked_dll out and start to reverse. I pretty sure this is continuously function of that dll but this line show up. So what is this line and can i remove it for my static reverse stage ? Thanks all

1 Answer 1

2

The dashed line is added by IDA to denote code flow boundaries. For example, you can see another one after the unconditional jmp, and there should be one after each retn instruction. In graph view they correspond to the end of function graph nodes.

The most probable cause for the one after call is that the called function has been detected as non-returning.

You can go inside the call and see if "Attributes: noreturn" is printed in the function header. If the function does, in fact, return, you can clear the flag by editing the function properties (Alt-P).

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.