I have large PE file (C++), which has lots of indirect function calls using vtable
and jmp dword
.
How can I generate a call tree for such functions ? (like with IDA User xrefs chart menu).
Here is an example of disassembled code:
UPX1:2401135C sub_2401135C proc near ; CODE XREF: sub_2401263C+Cp
UPX1:2401135C ; StartAddress+21p ...
UPX1:2401135C test eax, eax
UPX1:2401135E jz short locret_2401136A
UPX1:24011360 call ds:off_24057054
UPX1:24011366 or eax, eax
UPX1:24011368 jnz short loc_2401136B
UPX1:2401136A
UPX1:2401136A locret_2401136A: ; CODE XREF: sub_2401135C+2j
UPX1:2401136A retn
UPX1:2401136B ; ---------------------------------------------------------------------------
UPX1:2401136B
UPX1:2401136B loc_2401136B: ; CODE XREF: sub_2401135C+Cj
UPX1:2401136B mov al, 2
UPX1:2401136D jmp sub_2401141C
UPX1:2401136D sub_2401135C endp
User xref chart can show only call ds:off_24057054
branch if I will include data xrefs. What can I do to see the jmp sub_2401141C
branch ?