0

I am new to IDA Pro and am not familiar with anything beyond default settings for decompilation. I have an ELF64 kernel module compiled with gcc and, in several cases, IDA Pro's decompilation is splitting one function into two with the first function being identified by its proper symbolic name but the second is named after its address (e.g. sub_31B0).

An analysis of the disassembly shows that the said function's entry address has a typical function preamble and sets up the stack frame, does some things, and then calls leaveq/retq. This is then followed by a 13-byte-wide nop of some kind - I assume to align on the correct boundary - and then another function entry and ultimately leaveq/retq.

'objdump', 'gdb', etc. correctly identify the function in its entirety including the multiple entry/exits. However IDA Pro 7.5SP3 does not and generates two separate functions as stated above. Is there some option I am missing that considers these situations during decompilation? What compile flags on gcc results in this kind of output?

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.