0

I know that red addresses means, that code do not recognize as a function in IDA, because that code never get called. But I have found a piece of code that is marked red, but when debugging, I saw that this code gets called. But I still can't get that graph view of that piece of code and it still marked red. Can someone please explain what's happening here..?

1

To make IDA recognize the code as a procedure, press P at the start of it.

Ida "automatically presses the P key" if it sees a direct call to that address. However, if the source code was C++ or another language with classes, the function might never be called directly, only indirectly through the vtable (table of method start addresses) of the class. In this case, you'll have to mark the procedure manually.

  • Can you explain or give a reference to look at, how to mark the procedure manually..? – Ramesh-X Jul 21 '15 at 12:02
  • 1
    Not sure if I understand your question - put the cursor at the start of the red area, and press the P key, just like i said in my answer. – Guntram Blohm supports Monica Jul 21 '15 at 12:06

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.