📚 OpenRCE is preserved as a read-only archive. Launched at RECon Montreal in 2005. Registration and posting are disabled.








Flag: Tornado! Hurricane!

 Forums >>  IDA Pro  >>  Fix ida analysis mistakes

Topic created on: June 30, 2008 08:18 CDT by stam321 .

Hi all,

How can I fix IDA mistakes?

For example if I have a chunk of code IDA identified
as a function but it belongs to some other function
(I have tried to undefine it but ida still doesnt marks
this code as part of the real function).

A second example is when a block ends with "int 3" ida
sometimes marks the code after the int 3 as part of the
same function, sometimes its true,
but how do i fix it if its wrong.
Is it possible to fix it using IDAPython script?

thx,
  stam

  avri   June 30, 2008 14:08.38 CDT
Have you tried pressing 'P' on the first instruction of the function?

  jduck     June 30, 2008 17:05.50 CDT
perhaps there is a function like CxxThrowException that doesn't return before the int3?  using "edit function" (alt-p) on CxxThrowException and setting it to not return might fix the problem...

  stam321     July 1, 2008 00:14.05 CDT
I am not sitting in front of ida now but
if i remember right the "int 3" isnt reachable i think
its there for padding.
And yes I have tried pressing p.

  aLS     July 1, 2008 07:23.54 CDT
and.. Have you tried pressing 'E' (Set function end) on the last function's instruction?

Note: Registration is required to post to the forums.

There are 31,328 total registered users.


Recently Created Topics
[help] Unpacking VMP...
Mar/12
Reverse Engineering ...
Jul/06
let 'IDAPython' impo...
Sep/24
set 'IDAPython' as t...
Sep/24
GuessType return une...
Sep/20
About retrieving the...
Sep/07
How to find specific...
Aug/15
How to get data depe...
Jul/07
Identify RVA data in...
May/06
Question about memor...
Dec/12


Recent Forum Posts
Finding the procedur...
rolEYder
Question about debbu...
rolEYder
Identify RVA data in...
sohlow
let 'IDAPython' impo...
sohlow
How to find specific...
hackgreti
Problem with ollydbg
sh3dow
How can I write olly...
sh3dow
New LoadMAP plugin v...
mefisto...
Intel pin in loaded ...
djnemo
OOP_RE tool available?
Bl4ckm4n


Recent Blog Entries
halsten
Mar/14
Breaking IonCUBE VM

oleavr
Oct/24
Anatomy of a code tracer

hasherezade
Sep/24
IAT Patcher - new tool for ...

oleavr
Aug/27
CryptoShark: code tracer ba...

oleavr
Jun/25
Build a debugger in 5 minutes

More ...


Recent Blog Comments
nieo on:
Mar/22
IAT Patcher - new tool for ...

djnemo on:
Nov/17
Kernel debugger vs user mod...

acel on:
Nov/14
Kernel debugger vs user mod...

pedram on:
Dec/21
frida.github.io: scriptable...

capadleman on:
Jun/19
Using NtCreateThreadEx for ...

More ...


Imagery
SoySauce Blueprint
Jun 6, 2008

[+] expand

View Gallery (11) / Submit