Hi everyone,

I'm just starting to play around with IDA and I was wondering if someone could help me with this simple query.

I have a call like this:

.text:00401141 call sub_401390

which leads to ...

.text:00401390 sub_401390 proc near ; CODE XREF: sub_4010B4+8D
.text:00401390 ; sub_4010B4+1F2
.text:00401390 jmp ds:GetDlgItemTextA
.text:00401390 sub_401390 endp

What do I have to do in IDA to make the call sub_401390 into a call GetDlgItemTextA without renaming it manually? For some files I dissasemble, IDA does this automatically, yet for others it doesn't.

The file in question (based on http://www.crackmes.de/users/lafarge/lafarges_crackme_2/) is a very simple crackme which I chose as it is exactly that - simple. Hopefully if I start with a simple program and work my way up, I can learn IDA step by step.

IDA appears to do this to the file when it has had imports added to the original file. I had added a SetWindowTextA import using a PE Editor (Snippet Creator) yet I never call that import from within the file (I was just messing around with it).

So now my question is this : How do I get IDA to recognise this and thus decode it correctly?

File is available here if anyone wants to look (with the added import, not the original).

http://rapidshare.de/files/15064373/test.rar.html

The problem seems to be the same on multiple versions of IDA from 4.3 -> 4.8 as everyone else I know with a copy has tried to get it to decode correctly but with no luck. Since it apparently does this with the 'official' 4.3 free version, I don't think it is one of the 'deliberate' errors that certain copies *cough* of IDA contain.

Thanks in advance

Hi.
I have no problems loading the file with ida 4.3. Ida recognises the function automatically. I haven't touched/changed anything from the configuration files, it's a virgin ida
Did you changed something in the configuration files? Don't know, try to download it again...

Regards,
ZaiRoN

Well, this is strange... in every IDA Pro version I have seen (that is 3.84 to 4.8) you have a specific analysis option to handle this, and, as Zairon said, it is enabled by default.

However, please go to "Options->General" then select analysis options tab, and click "Kernel options 1"... You should see a checkbox: "rename jump functions as j_..." please check that it is enabled...

Hope this helps...

ZaiRoN and Polaris,

Yes it was my copy. I downloaded the 4.3 free version and that decoded it just fine. I guess I should do more testing myself rather than ask people "does it do the same there" and base myself on that.

4.9 does it nicely too Shame about the flowcharts though ... but working on a fix for that.

Thanks for your time.

bb