0

disassembled code in ida

disassemble code in xcode

I have built an executable file (the architecture is ARMv7, the base SDK is iOS), which depended on an xxx.a file in xcode; I don't have the source code of thexxx.a.

I want to check some logic in `xx. So I copy the final executable file to my Windows PC, use IDA 7.5 to disassemble it. At the same time, I debug this file in xcode using lldb.

The pictures show some strange thing. There is an unk_xxx in IDA but in xcode there is some other ARM instructions.

Question one: Why there is an unknow flag in IDA views?

I searched this on Google but there is nothing valuable. Can there is a possibility IDA 7.5 can not support adrp instruction. So it treats instruction as adrl ,so some error happens.

Question two: Is there any way to fix it?

As there is an unk_xxx in IDA text view, I found some content missing in pseudocode. This blocked me to read the whole logic of this function. I hope someone can give me some insight, so I can push on.

Thanks very much!

When ADRL is been detected, unk_xxxx appears, then pseudocode of disassembling code of this function are missing.

Pseudocode miss in Ida

Improve this question

1 Answer 1

Reset to default
1

ADRL is a pseudo instruction and is normally encoded as two instructions according to documentation

so probably it is a different convention being followed by both those tool

ida is probably showing the pseudocoded ADRL
while the other one is showing a split double instruction adrp,add

also note ida's dispaly does not have the ...c8 while the other has it

Improve this answer
5
  • Think you, blabb. Ida detect adrl , I do think it's fine . I add some descritions to the answer. Ida shoudn't miss some presudo code . If ida can not treat adrl ,it may detect it as two spit double instruction adrp and add. Now it treat it as adrl , not only the pseudocode of this instruct is missing ,and the pseudocode after the this instruction also missing . This is really unacceptable, and I can't carry on my analysis . I think this may be a bug of Ida. Can you give me some advice how to handle this situation ? Thanks very much!
    – KHacker
    Aug 17, 2021 at 6:57
  • Hi, Blabb. I think Adrl is affected by alsr. so ida can't get the real jump address . The real address is caculated at runtime. So the behaviour of ida is in expectations . Am I right?
    – KHacker
    Aug 17, 2021 at 9:04
  • I think I have made some mistake on my last comment . Although Adrl is affected by alsr, the disaccemble code should be adrl lable_offset, it shouldn't be unk_xxxx. There is another possibilty . Ida can't get the real jump address (offset of instruction to jump). The real address is caculated at runtime. So the behaviour of ida is in expectations .
    – KHacker
    Aug 17, 2021 at 9:23
  • aslr shouldn't matter post relevent text instead of image see what or where x9 is initialzed the last add has a18 in both so both representations seems right i am not that well versed in arm what i posted is an observation it was not about the quality of either tool
    – blabb
    Aug 17, 2021 at 10:13
  • You can disable the recognition of pseudo-instructions in the analysis options, if you require to see the raw adrp/add instructions.
    – Michael Karcher
    Aug 20, 2021 at 15:18

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.