I have a function
MyFunc in an obfuscated program as follows:
Start address: .text:000000014219FC5D End address: .text:000000014219FD0E
MyFunc starts off by jumping to
.text:000000014143C159, which is recognized correctly by IDA as
FUNCTION CHUNK FOR MyFunc.
This basic block jumps to
.text:000000014000B524, which is not recognized correctly by IDA. IDA recognizes it as a completely unrelated function. There are 0 other xrefs to this block in the program.
I'm guessing the problem is that the basic block is lower in address than the function start, so IDA can't consider it as a basic block of
MyFunc. I'm guessing that the obfuscator splits basic blocks and then shuffles them (mixing them together with BBs from other functions).
What is the recommended approach to take in order to get analysis working?