4

I'm using IDA 6.1 32-bit version.

I'm pretty new to IDA and Hex-rays decompiling. My goal is to generate some C source from a 32-bit PE executable. I know this file is 32-bit PE executable. I've looked at the header struct in a hex editor and confirmed that it has the PE header segment. When I dissassemble the file in IDA Pro, it recognizes that it is an x86 PE executable file.

Further, IDA produces the following output after analyzing the header segment:

; Format      : Portable executable for 80386 (PE)
; Imagebase   : 400000
; Section 1. (virtual address 00001000)
; Virtual size                  : 011DAC9D (18721949.)
; Section size in file          : 011DB000 (18722816.)
; Offset to raw data for section: 00001000
; Flags 60000020: Text Executable Readable
; Alignment     : default
; OS type         :  MS Windows
; Application type:  Executable 32bit

However, when I select a function and attempt F5 to open the Pseudocode window, I am greeted with the unhelpful message:

Decompilation failure: FFFFFFFF: 16bit functions are not supported

Please refer to the manual to find appropriate actions

So, I referred to the manual, which is also unhelpful:

The message text says it all. While the decompiler itself can be fine tuned to decompile 16-bit code, this is not a priority for now. May be in the future it will support 16-bit code.

The thing is that this isn't 16-bit code. What am I doing wrong?


PS If I need to provide more information to help in answering this question, please let me know. I'm very new to IDA/Hex-rays and I'm not sure what else would be useful here.

  • 1
    A link to a copy of the actual file would help (and have you verified that the file is not corrupted?) – peter ferrie Sep 26 '13 at 17:04
  • 1
    I can run the file so it's not corrupted. I don't have permission to paste a copy of the file. I might be able to paste bits and pieces of information if you steer me in the direction to what you are looking for. I'm mainly interested in understanding why Hex-rays thinks this is a 16bit application, when it is clearly 32bit. – crush Sep 26 '13 at 17:12
  • When you view the segment in the Segment View (Shift+F7) does the AD field show 16 or 32? – Simeon Pilgrim Oct 10 '13 at 2:42
  • 1
    I found a application which does this exactly, every function (30000 of them) is FFFFFFFF: decompilng 16bit functions are not supported seems to be some obfuscator that tricks IDA? – SSpoke Jun 10 '14 at 20:16
  • 2
    It would probably be a lot easier to figure out what's going on given excerpts from the disassembly, such as an affected function or the beginning of the segment ... – SamB Apr 19 '16 at 3:41

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.