Topic created on: June 16, 2007 16:28 CDT by Sirmabus .

If you use IDA a lot you must know that while it is fantastic, it still misses or incorrectly parses some code after it's final pass.  It can be much worse on some executables then others.

I normally do a fix manually (for 32bit flat mode Windows executables).

If you don't know, you can start at the top of the ".text" segments and text search down for every " dd ".
You will hit most of the badly resolved sections.
Here you can press the 'C', 'P' and some times 'D'.
If you want to be more complete, you can start over again searching for " db ".  That should catch any remaining stay code spots.

While normally, it's a quick work, maybe 30minutes or so.
But try it on a 10mb (100mb+ IDA DB) executable with around 50k functions, a big percentage disconnected in vtables and callbacks and it's gets a bit overwhelming (literally takes 3 or 4 hours to fix!).

Anyone know of some helper scripts or a plug-in to do some of this?
If not, I'll start a little openrce project for it here. Hopefully these tasks could be at least partially automated. A lot of the mixed-up/bad code sections have patterns to it.  Like the NOP or INT3 alignment padding bytes. And, or, there are a lot of patterns to the stack frames.
Maybe examining the distance from one function to the next in code spaces...