Currently I am analyzing a .so file and there is a function which is supposed to be large (high number of nodes and edges). However, IDA Pro identified it as a small function, with various parts of the code being treated as individual sub routines and some of them have attributes of "no return".

I tried to use append_func_tail to combine the sub routines together but the function returns false.

I am trying to do these

  • Combine the various sub routines together into one main sub routine
  • Calculate the cyclomatic complexity value of this big sub routine

Is there a way to do the above?

  • Hi and welcome to RE.SE! Can you provide an ida database of binary containing the function in question?
    – Nordwald
    Jan 31 '19 at 10:47
  • If these function fragments are placed sequentially, manual fix is possible. Delete all the functions that IDA created instead of function fragments (AFAIR, Edit-->Functions-->Delete function). Select all the instructions that should be in the large function, and press P. This should create a large function from the selected instructions.
    – w s
    Jan 31 '19 at 13:42
  • unfortunately, I cannot share the database because the file is proprietary and I am not allowed to share it. I see some suggestions below to try out, will try them.
    – localacct
    Feb 7 '19 at 2:47
  • I would like to add that the functions are not located sequentially but "scattered" throughout
    – localacct
    Feb 7 '19 at 2:53

If IDA has erroneously marked functions as "noreturn", you can manually edit this with Alt-P. "Does not return" is a checkmark that you can select. Once you've removed this attribute, IDA should properly disassemble the code following the function call -- though you may need to delete functions (as the comment said) if IDA is using obsolete information about the function boundaries.

  • Rerunning IDA's autoanalysis (Options->General->Analysis->Reanalyze program) will fix/adjust most of the incorrectly analyzed functions. That's worth trying before manually deleting functions.
    – NirIzr
    Feb 4 '19 at 12:29
  • hey folks! Thanks for the reply, will try the suggestions.
    – localacct
    Feb 7 '19 at 2:46
  • Hi folks, I unchecked the "no return" attribute, deleted the sub routines and ran analysis again but IDA Pro just identify those sub routines as individual sub routines as per its original analysis. I was not able to manually highlight the code portions and indicate them as one big function as they were not located sequentially. Anything else I can try?
    – localacct
    Feb 7 '19 at 3:10

Your Answer

