0

I am trying to reverse engineer a DLL file, but I am getting this warning when it's loaded:

Warning message

As well, then on some of the functions error appears sp analysis failed like on this picture:

Error message

Is it possible to get code from that function ?

Once in pseudo code, there is only ";" inside the function. Parameters do match.

http://i.imgur.com/0Y2ccpx.png

7
  • Not enough information regarding the stack.Open IDA, go to options-->general, enable stack pointer checkbox. You will see the stack pointer value on each instruction of the function. This will allow you to see where exactly there is a problem.
    – w s
    Sep 10 '14 at 5:42
  • @ws i.imgur.com/0Y2ccpx.png I am not to sure what is causing this error. I've been trying to do what IDA is saying, but might have done it wrong. hex-rays.com/products/ida/support/idadoc/1368.shtml
    – Conrad
    Sep 10 '14 at 6:00
  • As I see now this is obfuscated function (which means it is not standard assembly generated by compiler directly, this code was transformed). AFAIK IDA doesn't handle such kind of things good. You can try this: opticode.coseinc.com to deobfuscate the code.
    – w s
    Sep 10 '14 at 6:20
  • @ws I've been trying to put bits of code in there but it keeps giving me errors. especially on "arg_8 = dword ptr 0Ch", and declaration of DllEntryPoint. Will this help? dropbox.com/s/8yjjitd98aa7zrn/RGSS301%201080p.asm?dl=0
    – Conrad
    Sep 10 '14 at 8:28
  • 1

Browse other questions tagged or ask your own question.