I am a newbie to RE and IDA Pro 7.2, and I am working my way through the book Practical Malware Analysis. I'm currently working on the lab 15-01 problem in the anti-disassembler chapter, but am having difficulty reproducing part of the solution in my environment.

I solved the lab by redefining some bogus opcodes into data, and now I have reasonable disassembly listings to look at. So far, so good. But at the end, the solution tells you to turn this fixed-up section into a function using the "P" hotkey. That doesn't work for me: I get this message in the output window:

.text:00401010: The function has undefined instruction/data at the specified address.
Your request has been put in the autoanalysis queue.

The address points to the first data definition I made.

Trying to flip over to graph mode doesn't work either. I get a popup that tells me that only instructions belonging to functions can be displayed in graph mode.

If I go to the Problems tab, I see lines like this:

.text:00401062  NONAME      db 0E8h

But I didn't glean anything in the IDA Pro help file for no name problems that helped me with my specific situation.

Ultimately, I used Edit -> Patch Program -> change byte to NOP out the data bytes and turn them into code. Then I had a function that I could graph.

My question is, is there a way to do this without patching bytes?

EDIT: Added error message text to the post.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.