3

Some instructions in a binary do not belong to a function, or, IDA does not manage to recover one. See for example the red addresses in the below screen shot.

Yet, one can right-click such 'function-less' addresses and selct Create function from the menu (see below screenshot).

Are there any side effects of creating a function from 'function-less' instructions? For example, does it change instructions, symbols, variables, etc.? Does it change IDA-generated xrefs and thus has an effects on a static control flow analysis?

I am asking because I have to work with an algorithm that can only process instructions which belongs to a function. My idea was to go through the binary and keep creating functions until all 'function-less' instructions belong to a function.

Do you see any possible disadvantages of this approach?

enter image description here

6

Depends on what you would call a disadvantage. This kind of code-relict often results from a function that's present in source code, but doesn't ever get called*, so IDA didn't assign a name to it. If this is the case, you:

  • generally don't want to include the function in your analysis, because the program never uses it anyways
  • can search for a longer sequence of functions that are unused**, which might identify whole source files that got linked in accidentially but aren't used in the program
  • can use the space of these functions for code caves that "enhance" the program's functionality; for example, i sometimes use them for a sequence of open/write/close calls that log some intermediate values.

You sabotage this by making unused functions real functions, which may or may not be important to your use case.

(*) However, the function might be a class method, which is referenced from the vtable, but never called directly, which misleads IDA

(**) If you have two functions a and b, both of which get never called from the outside, but a calls b, IDA will still give b a sub_ name, which interferes with identifying unused functions

| improve this answer | |
  • Good point. Your answer confirms my assumption that "Create function" is a purely IDA-internal thing. I mean, it does not change any instructions, symbols, variables, etc. It shouldn't change any xrefs either and thus shouldn't have any effects on a static control flow analysis, right? Or am I missing something? – langlauf.io May 28 '15 at 7:23
3

There is another point that might be problematic. Sometimes on some platforms IDA does not recognize code areas correctly and defines data as a code in complicated functions or complicated code at all. Defining this code as a function may insert it to auto-analysis queue and all incorrectly defined references from this mistakenly recognized code may break another functions. This problem also occurs when working with obfuscated code.

Unfortunately as @Guntram Blohm said, the functions that called indirectly might be not recognized as such, so the solution for this problem is still needed. I'd suggest a bit better algorithm for creating such functions: Don't convert each instruction to function automatically. Find all function prologues instead (for example something like 2 pushes in the functions on your picture), and try to create a function where you can recognize this prologue only.

It can be done with IDAPython by using function idc.MakeFunction(prologue_address) without second parameter. In such case IDA will try to define function borders automatically.

| improve this answer | |
  • IIRC the plugin IDAScope does a good job at that – Carlos Garcia May 28 '15 at 17:20
  • @w s: Just to be sure, creating a function does not change instructions, symbols, variables, etc., right? Does it change IDA-generated xrefs? – langlauf.io May 29 '15 at 18:57
  • 1
    @stackoverflowwww It may change instructions and xrefs. It is particularly problematic when working with obfuscated code. – w s May 31 '15 at 5:26
  • @ws could you give me a link to more info about when , why , and what xrefs may be added? Maybe even an example? Or should I open a new question? – langlauf.io May 31 '15 at 6:45

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.