How to convert Unexplored data in IDA Pro to code？

Question

I am analyzing a malware, it has a lot of confusing methods, I wrote an idc script to remove confusion, use the MakeCode() function to convert some Unexplored data into code, but there are still some that can't be converted when you manually convert When some Unexplored data, it will pop up a window to prompt you whether to convert, so I need a method to force the conversion of Unexplored data to code. Does anyone know which api script language can implement such a function? I used FindUnexplored to find Unexplored data.

Answer 1

Using MakeCode function with idc or idaPython is completely OK, this function is exactly what you need. However (especially when analyzing malware) you can encounter the following problems:

• It may be encrypted (like AES or other encryption algorithm) or transformed (like xored with some pattern) code. Obviously, it can not be disassembled as is.
• It may be obfuscated code with garbage bytes inside (something like jmp $+6;garbage byte;code to jump to ). In general IDA should handle it, but if you starting your conversion from incorrect byte it will be garbage. This problem can be found in architectures with non-constant instruction length, such as x86 or x64.
• It may be just data. Not all unexplored bytes are the code.
• It may be some exotic variant of instruction that IDA disassembler can not handle.While theoretically possible, it is highly unlikely.