How to get address where MakeFunction() failed in IDA Pro

Question

I am analysing obfuscated code which contains code paths leading to dummy instructions. These dummy instructions prevent IDA from creating functions. However, I need these functions to do a function matching with Bindiff.

While I was patching these functions manually, the output of the "Make Function" feature (by pressing "p") contained the address where it encountered a problem. This information was very helpful to pinpoint the next dummy instruction.

To speed up this process I started to write a Python script. I managed to identify the start addresses of functions containing dummy instructions. However, unlike in the IDA Pro UI the API function MakeFunction() only returns true or false to indicate a (un)successful creation.

I tried to get the same address as reported in the output window by other means like "Jump to next unexplored", but no luck. The only other way I found is to use the "Jump to Problem" option which again I only can access in the UI.

Is there a way to get the address where MakeFunction() failed in Python, just like in the UI?

Answer 1

Solution:

find_func_bounds() does the trick (see SDK documentation). That's how it works:

pfn = func_t()
find_func_bounds(ea, pfn, FIND_FUNC_NORMAL)
pfn.endEA

If the return value of find_func_bounds() is FIND_FUNC_UNDEF (0), pfn.endEA contains the address where it encountered unexplored bytes.