IDA Pro: Side effects or disadvantages of "Create function"

Question

Some instructions in a binary do not belong to a function, or, IDA does not manage to recover one. See for example the red addresses in the below screen shot.

Yet, one can right-click such 'function-less' addresses and selct Create function from the menu (see below screenshot).

Are there any side effects of creating a function from 'function-less' instructions? For example, does it change instructions, symbols, variables, etc.? Does it change IDA-generated xrefs and thus has an effects on a static control flow analysis?

I am asking because I have to work with an algorithm that can only process instructions which belongs to a function. My idea was to go through the binary and keep creating functions until all 'function-less' instructions belong to a function.

Do you see any possible disadvantages of this approach?

Answer 1

Depends on what you would call a disadvantage. This kind of code-relict often results from a function that's present in source code, but doesn't ever get called*, so IDA didn't assign a name to it. If this is the case, you:

• generally don't want to include the function in your analysis, because the program never uses it anyways
• can search for a longer sequence of functions that are unused**, which might identify whole source files that got linked in accidentially but aren't used in the program
• can use the space of these functions for code caves that "enhance" the program's functionality; for example, i sometimes use them for a sequence of open/write/close calls that log some intermediate values.

You sabotage this by making unused functions real functions, which may or may not be important to your use case.

(*) However, the function might be a class method, which is referenced from the vtable, but never called directly, which misleads IDA

(**) If you have two functions a and b, both of which get never called from the outside, but a calls b, IDA will still give b a sub_ name, which interferes with identifying unused functions

Answer 2

There is another point that might be problematic. Sometimes on some platforms IDA does not recognize code areas correctly and defines data as a code in complicated functions or complicated code at all. Defining this code as a function may insert it to auto-analysis queue and all incorrectly defined references from this mistakenly recognized code may break another functions. This problem also occurs when working with obfuscated code.

Unfortunately as @Guntram Blohm said, the functions that called indirectly might be not recognized as such, so the solution for this problem is still needed. I'd suggest a bit better algorithm for creating such functions: Don't convert each instruction to function automatically. Find all function prologues instead (for example something like 2 pushes in the functions on your picture), and try to create a function where you can recognize this prologue only.

It can be done with IDAPython by using function idc.MakeFunction(prologue_address) without second parameter. In such case IDA will try to define function borders automatically.