How can I call IDA Pro's MakeCode for one instruction at a time?

Question

I have undefined a block of code and I want to manually reconstruct this block by iterating over the area while decoding undefined bytes and calling idc.MakeCode for each instruction separately.

I have disabled auto-analysis, but calling MakeCode on the head of the block causes the entire block to be converted to code. I can't find anything in IDA Python / IDC to do this that isn't a hook. Is there an analysis flag I need to set in order to prevent this behavior?

Answer 1

This is a bit of a tricky question, because technically MakeCode is not what causing the rest of the code to be analyzed as code. A hint for that can be the fact that MakeCode actually returns the length of the current instruction. It is only later that additional following bytes are being converted to code (if possible).

Thing is, that for IDA to do what IDA is good at (that is, successfully disassembling large code bases) it has it's own background code analyzer. That Code Analyzer is in charge of orchestrating high level disassembly operations such as figuring out where functions start, make sure all functions are analyzed, handle overlapping code to the best of it's ability, etc...

One of the features of IDA's Code Analyzer is the code analysis stack. That stack contains "leads" to additional unexplored code and hints towards where additional assembly code might be found. While idc.MakeCode indeed only converts a single instruction to code, it registers the end of that instruction with the Code Analyzer, which then proceeds to analyze and convert the rest of the binary to code (as long as valid instructions are found).

To disable the auto analysis running in the background hit the "Options" menu and the "General" function in it. In the dialog select the "Analysis" tab and uncheck the checkbox labeled "Enabled" to the left, as shown in the following picture

Fun fact: You can call idaapi.analyzer_options() to show that dialog. You'll still need to uncheck the checkbox and hit the "Ok" button. Unfortunately it seems there's no API for that.

Answer 2

NirIzr's answer has a major drawback: All those locations following the decoded instructions are still added to the analyzer queue, they're just not being processed. That means if you ever enable analysis again, IDA will go back and process them all, completely obliterating whatever your script did.

A better solution is to go into "Kernel options 1" and uncheck "Trace execution flow" before running your script. That's the one responsible for adding an address immediately following a decoded instruction into the analysis queue, so this way those addresses won't be added to the queue in the first place. When your script is done, you can go back and check it again and continue using IDA with analysis enabled.