0

I need assistance in ida pro regarding sp analysis failure. The link to the dissembled function is here: http://pastebin.com/XRwzswgS The program has a lot of these errors which hinders hexrays decompilation. The analysis failure is shown in line 333 in pastebin. I have included the SP pointer values from ida

3

In a line 34 you have a following code:

.text:0046FC96 010                 mov     eax, 3AFCh
.text:0046FC9B 010                 call    __alloca

This code allocates 0x3afc bytes on stack and this allocation is not reflected in IDA stack analysis (if the assumption that _alloca function detected and defined correctly is correct, see linux alloca man page and MSDN alloca documentation for more details about this function).

To fix this you should go to call _alloca instruction, press ALt-K and insert the needed value (probably -0x3afc in your specific case, but I'm not sure).

This will hint IDA that there is a stack pointer change here.

1
  • By the way, this specific problem may be solved automatically with IDAPython. ALT-K is alike IDAPython api function idaapi.add_user_stkpnt(ea, delta), all the rest is obvious. – w s Jul 28 '15 at 11:15

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.