I'm currently working on an IDAPython script that aims to remove various rogue-byte from the malware that I'm reversing.

I'm in a case where some portions of my code contain this type of anti-disassembly trick: enter image description here

The fact is that without patching the rogue byte, I can't define this undefined blob as a proper function (P shortcut).

So the script is basically doing this:

  • Find the following opcode: "90 C3 FE" (for "nop, retn, FE", FE is the rogue-byte).

  • Patch the "FE" byte and replace it by a NOP (0x90).

  • Define the new NOP as code.

As all the function having this rogue-bytes in it are undefined, I now need to define them as proper function.

But I don't know how to go back to the address of the beginning of the undefined function. For instance, that's the result after executing my IDAPython script: enter image description here

The rogue-byte is indeed patch, but now I just need to find the address of "loc_410687".

How can I get this address within my IDAPython script?

(I specify that not all of the function that contains the rogue-byte start by those 3 xors, that's a coincidence. So I can't look for them in order to get the start of the function.)

Any idea?


  • That's the PonyLoader btw. for which the source got leaked: github.com/nyx0/Pony/blob/master/source/PonySrc/Pony.asm Search for "AntiDisasmTrick" - at least in the sourcecode those 3 xors are fixed. Aug 3, 2019 at 7:42
  • Yeah, that's indeed a pony sample! That's amazing how you recognize it with only 20 instructions :) Thanks for the source code, it's really helping me
    – Guillaume
    Aug 3, 2019 at 20:45
  • Did you try to reanalyze program after all patching is done ?
    – w s
    Aug 4, 2019 at 10:30
  • Yes, I started the analysis even before the rogue-byte things, I'm just trying to make the code cleaner and more pleasant to look at ^^ It even work perfectly in a debugger, the rogue-byte are not affecting anything !
    – Guillaume
    Aug 4, 2019 at 13:12


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.