I am a newbie to RE and IDA Pro 7.2, and I am working my way through the book Practical Malware Analysis. I'm currently working on the lab 15-01 problem in the anti-disassembler chapter, but am having difficulty reproducing part of the solution in my environment.
I solved the lab by redefining some bogus opcodes into data, and now I have reasonable disassembly listings to look at. So far, so good. But at the end, the solution tells you to turn this fixed-up section into a function using the "P" hotkey. That doesn't work for me: I get this message in the output window:
.text:00401010: The function has undefined instruction/data at the specified address.
Your request has been put in the autoanalysis queue.
The address points to the first data definition I made.
Trying to flip over to graph mode doesn't work either. I get a popup that tells me that only instructions belonging to functions can be displayed in graph mode.
If I go to the Problems tab, I see lines like this:
.text:00401062 NONAME db 0E8h
But I didn't glean anything in the IDA Pro help file for no name problems that helped me with my specific situation.
Ultimately, I used Edit -> Patch Program -> change byte to NOP out the data bytes and turn them into code. Then I had a function that I could graph.
My question is, is there a way to do this without patching bytes?
EDIT: Added error message text to the post.