2

I am analysing obfuscated code which contains code paths leading to dummy instructions. These dummy instructions prevent IDA from creating functions. However, I need these functions to do a function matching with Bindiff.

While I was patching these functions manually, the output of the "Make Function" feature (by pressing "p") contained the address where it encountered a problem. This information was very helpful to pinpoint the next dummy instruction.

To speed up this process I started to write a Python script. I managed to identify the start addresses of functions containing dummy instructions. However, unlike in the IDA Pro UI the API function MakeFunction() only returns true or false to indicate a (un)successful creation.

I tried to get the same address as reported in the output window by other means like "Jump to next unexplored", but no luck. The only other way I found is to use the "Jump to Problem" option which again I only can access in the UI.

Is there a way to get the address where MakeFunction() failed in Python, just like in the UI?

1 Answer 1

4

Solution:

find_func_bounds() does the trick (see SDK documentation). That's how it works:

pfn = func_t()
find_func_bounds(ea, pfn, FIND_FUNC_NORMAL)
pfn.endEA

If the return value of find_func_bounds() is FIND_FUNC_UNDEF (0), pfn.endEA contains the address where it encountered unexplored bytes.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.