6

I'm using IDA 6.1 32-bit version.

I'm pretty new to IDA and Hex-rays decompiling. My goal is to generate some C source from a 32-bit PE executable. I know this file is 32-bit PE executable. I've looked at the header struct in a hex editor and confirmed that it has the PE header segment. When I dissassemble the file in IDA Pro, it recognizes that it is an x86 PE executable file.

Further, IDA produces the following output after analyzing the header segment:

; Format      : Portable executable for 80386 (PE)
; Imagebase   : 400000
; Section 1. (virtual address 00001000)
; Virtual size                  : 011DAC9D (18721949.)
; Section size in file          : 011DB000 (18722816.)
; Offset to raw data for section: 00001000
; Flags 60000020: Text Executable Readable
; Alignment     : default
; OS type         :  MS Windows
; Application type:  Executable 32bit

However, when I select a function and attempt F5 to open the Pseudocode window, I am greeted with the unhelpful message:

Decompilation failure: FFFFFFFF: 16bit functions are not supported

Please refer to the manual to find appropriate actions

So, I referred to the manual, which is also unhelpful:

The message text says it all. While the decompiler itself can be fine tuned to decompile 16-bit code, this is not a priority for now. May be in the future it will support 16-bit code.

The thing is that this isn't 16-bit code. What am I doing wrong?


PS If I need to provide more information to help in answering this question, please let me know. I'm very new to IDA/Hex-rays and I'm not sure what else would be useful here.

7
  • 1
    A link to a copy of the actual file would help (and have you verified that the file is not corrupted?) Sep 26, 2013 at 17:04
  • 1
    I can run the file so it's not corrupted. I don't have permission to paste a copy of the file. I might be able to paste bits and pieces of information if you steer me in the direction to what you are looking for. I'm mainly interested in understanding why Hex-rays thinks this is a 16bit application, when it is clearly 32bit.
    – crush
    Sep 26, 2013 at 17:12
  • When you view the segment in the Segment View (Shift+F7) does the AD field show 16 or 32? Oct 10, 2013 at 2:42
  • 1
    I found a application which does this exactly, every function (30000 of them) is FFFFFFFF: decompilng 16bit functions are not supported seems to be some obfuscator that tricks IDA?
    – SSpoke
    Jun 10, 2014 at 20:16
  • 2
    It would probably be a lot easier to figure out what's going on given excerpts from the disassembly, such as an affected function or the beginning of the segment ...
    – SamB
    Apr 19, 2016 at 3:41

0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Browse other questions tagged or ask your own question.