4

Recently I got a program that has two colors of .text segment, one is black and the other is brown:

enter image description here

While the flow chart and the decompiler work well on black part, they are both disabled on the brown part, as below:

enter image description here

Later, I found the brown .text part is categorized as Single instruction, rather than Regular function:

enter image description here

I wonder if there is a way, to make the Flow Chart and the Decompiler work for the Single instruction part?

1 Answer 1

4

The brown text is called as single instruction because the function, prologue of which we see in brown color, was not recognized by IDA as function.

There are many possible reasons for that, for example this function may be never called directly, or there is unrecognized instruction inside. In order to make this code a function (which will make it black) by defining it as a function yourself, you can press P when the cursor is located on address 0x00405fd0 where the function prologue starts, or select all the functions' instructions and press P.

When this code becomes function, the graphs and decompilation should start working.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.