0

I'm writing a python script for IDA to automate the deobfuscation of a binary.

After patching with a jmp instruction ida provides the following disassembly:

.text:008FD01E                 jmp     dword_502264+5A5DA0h

rather than showing "jmp loc_..."

If I apply the patch to the input file and renalyze it, the reference is recognized correctly. I tried to use add_cref with no success: it creates the loc_ at the target address but the reference is not present in the operand of the jmp.

I need the correct operand because without it the basic blocks are not connected in the graph view. Moreover this data reference may be confusing.

Edit: I realized that if I add the cross reference once the function is already defined I can see the connection between the basic blocks, but the operand is still wrong

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.