3

I am reversing a program with IDA Pro, but for some reason it cannot recognize a function inside the text section.

Can someone show me how to reformat the codes (in the figure) as a function?

Assembly

Improve this question

2 Answers 2

Reset to default
2

You should be able to go to encrypt_String and press P

Improve this answer
3
  • and if it doesn't work you should see an error message in the Output window, probably with the understandable reason why.
    – w s
    Nov 17, 2016 at 21:35
  • .text:026AFB5C: The function has undefined instruction/data at the specified address. Your request has been put in the autoanalysis queue. ??? i do not understand ? nothing happened later
    – SieuTruc
    Nov 18, 2016 at 19:24
  • 1
    @SieuTruc It looks like that IDA didn't recognize the data at this address (0x026AFB5C) as code . Save the database for backup and go to this address, and press <kbd>U</kbd> to undefine whatever it is there and then <kbd>C</kbd> , which will convert this data to code. After that press <kbd>P</kbd> on the start of the function again.
    – w s
    Nov 20, 2016 at 8:18
2

I experienced this error when function body contained some embedded data; it is normal for assembler code, but I never saw such technique with high level language, so code packers/obfuscators embed data pieces in code segment as anti-disassembling measure.

When unused random data appears in code, IDA can not detect function borders automatically.

So, in such obfuscated code, instead of Create function (or press P) at the function start you can use Set function end (or press E) at function end, and IDA will create function from last "non-function" code start to current function. From my experience, this way may work with P at the beginning of obfuscated function doesn't work.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.