I'm disassembling a function that seems to use a switch statement, resulting in an indexed indirect jump, in two different places (same function!):
0005FA58 mov al, [eax+112h] 0005FA5E cmp al, 4 0005FA60 ja loc_5FBED 0005FA66 and eax, 0FFh 0005FA6B jmp cs:off_5F98C[eax*4] 0005FA73 00060011 mov al, byte ptr unk_A4E30[eax] 00060017 cmp al, 3 00060019 ja short loc_60053 0006001B and eax, 0FFh 00060020 jmp cs:off_5F9A0[eax*4] 0005F98C off_5F98C dd offset loc_5FBCC, offset loc_5FA73, offset loc_5FAC5, offset loc_5FB14, offset loc_5FB66 0005F98C ; DATA XREF: FunctionStart+BB 0005F9A0 off_5F9A0 dd offset loc_60049, offset loc_6003E, offset loc_60031, offset loc_60028 0005F9A0 ; DATA XREF: FunctionStart+670
The first jump table has 5 entries, the second one 4. Unfortunately, the compiler placed them directly behind each other in memory. This seems to confuse IDA when calculating the graph connections for those nodes:
Edit, as the the wording of the question was probably misleading
The graph node shows 9 outgoing connections. 5 of them are true connections, the next 4 are not - they belong to a different jump table that happens to be directly after this one in memory. I'd like to tell IDA "This jump table has 5 valid entries, ignore the other ones when creating the graph node". Is there any way to do this?
The original question was:
The first jump table has 9 connections, 4 of which don't belong to that statement. (The second one, ommited here for brevity, has only one connection). Is there any way to tell IDA to remove the extra connections from the first table, and possibly create new connections from the 2nd table to the corresponding targets?
I already tried defining the jump tables as arrays, then undefine the function and re-define it as code, but that didn't change anything.
(I'm using IDA 5.0, as this is a hobby project, and i don't want to spend several hundred bucks on something i'll use a few times a year).