I have a function MyFunc
in an obfuscated program as follows:
Start address: .text:000000014219FC5D
End address: .text:000000014219FD0E
MyFunc
starts off by jumping to .text:000000014143C159
, which is recognized correctly by IDA as FUNCTION CHUNK FOR MyFunc
.
This basic block jumps to .text:000000014000B524
, which is not recognized correctly by IDA. IDA recognizes it as a completely unrelated function. There are 0 other xrefs to this block in the program.
I'm guessing the problem is that the basic block is lower in address than the function start, so IDA can't consider it as a basic block of MyFunc
. I'm guessing that the obfuscator splits basic blocks and then shuffles them (mixing them together with BBs from other functions).
What is the recommended approach to take in order to get analysis working?