1

I analyzed a binary, and lots of functions weren't detected as such - the bytes weren't detected as assembly. I read about the Aggressive Instruction Finder analysis and used it. Now the instructions are detected, but the functions (at least some) aren't.

For a single function, I know that I can press F to define it. Is there any way to do that automatically for all/most undefined functions?

Example for an undefined function:

Screenshot

2

In ida you can make use of a idapython function called MakeFunction. You can basically iterate through the code and define undefined functions.

ExampleScipts: IDA MakeFunction

However If you ask this question specifically for Ghidra then I believe there's a plugin to run idapython scipts in Ghidra.

Run IDAPython scripts in Ghidra

Hope this helps.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.