IDA failed to display the program in graph mode

本文详细介绍了在使用IDA Pro时遇到图形模式显示程序错误时的常见原因及解决步骤,包括如何通过选择函数头创建新函数,以及如何在出现解析失败时手动修复代码。同时提供了解决过程中可能遇到的其他问题的建议。

Usually via the graph mode we can clearly see what and how the subroutine did,however lucky is not all the time with us,u may get an error message like above.

This error is mostly caused by fallow reasons:

1. there are to much nods that ida can’t change to graph mod,now here is no solution to fix this error

2.the current cursor pos is at a position that ida can’t recognize them as functions

3. a sp-anylized failure happened .

if the error is caused by the 2nd reason ,u can fallow these steps to fix this error:

to fix this error just select the function header,most time it is just like this(64bit):

1
2
3
4
5
6
7
.text:000000000049BA80 push    rbp
.text:000000000049BA81 mov     rbp, rsp
.text:000000000049BA84 sub     rsp, 50h
.text:000000000049BA88 mov     [rbp+var_8], rbx
.text:000000000049BA8C mov     rbx, r8
.text:000000000049BA8F cmp     cs:byte_9B1210, 0
.text:000000000049BA96 jz      loc_49BB

right click choose Create functions,like fallows :

then the ida will auto anylize the code and make it a new function from current cusor pos to the end (witch ida think it is the end ,not u ;) )

after the ida change the codes into function ,it will be appeared as this:

in this picture the red lines is still not recognized by the ida,if these codes are useful u have to fix them too.

then u can press the space button to view the code in graph mode.

now it is much better!lol :)

well ,ida is not Reliable all over the time ,sometimes it will lost.ended a function at the wrong line,at this time u have to fix the error urself by Edit function features that the ida provided :

if it not works ,u can uncheck the BP based frame check box.also if there are too much errors u have to change the process options when u load file .

that’s all.hope it useful to u. :)

 

原文: http://www.h4ck.org.cn/2011/12/ida-failed-to-display-the-program-in-graph-mode/
评论
添加红包

请填写红包祝福语或标题

红包个数最小为10个

红包金额最低5元

当前余额3.43前往充值 >
需支付:10.00
成就一亿技术人!
领取后你会自动成为博主和红包主的粉丝 规则
hope_wisdom
发出的红包
实付
使用余额支付
点击重新获取
扫码支付
钱包余额 0

抵扣说明:

1.余额是钱包充值的虚拟货币,按照1:1的比例进行支付金额的抵扣。
2.余额无法直接购买下载,可以购买VIP、付费专栏及课程。

余额充值