How to remove bytes/opcodes within IDA Pro database

Question

I am dealing with a heavily obfuscated binary, with certain portions of it having an abundance of junk code when it attempts to set a value at certain offsets to esp/ebp. My question, having identified the junk code from the actual code, is how can I remove the junk opcodes entirely and shorten the disassembly to the direct operation that it is employing? I have found no delete/remove bytes in the SDK, and short of a processor module, I am not sure if IDA has this capability, which would be a shame if it didn't.

• from:

add     ecx, 4  
mov     edi, 32F88Eh    ; junk  
and     edi, 34h        ; junk  
add     edi, 0aB0b2cE6h ; junk  
mov     ebx, 98761234h  ; junk  
mov     [ebp+edi+47652784], ecx; [ebp+0xa0]

The manipulations to edi are junk in the sense their value is actually static once you apply constant folding to it

• to:

add ecx, 4  
mov [ebp+0xa0], ecx

Answer 1

You can't just remove bytes since that would shift the following opcodes and invalidate all relative jumps/calls. The usual approach in such cases is patching the junk instructions with NOPs (0x90 for x86/x64). You can write a smalls script to do it (e.g. using patch_byte).

Answer 2

Answering my own question as an additional one to Igor's.

Using nops excessively is perhaps fine for a single routine, or certain instances (at least for me), but the solution I prefer in this case is just cleaning up the code manually outside of IDA, and then adding a separate segment for it into the idb. That way I don't have to modify the obfuscated code at all, and can have both (clean/dirty) versions, with the clean one becoming the target for further analysis.