I'm currently working on an IDAPython script that aims to remove various rogue-byte from the malware that I'm reversing.
The fact is that without patching the rogue byte, I can't define this undefined blob as a proper function (P shortcut).
So the script is basically doing this:
Find the following opcode: "90 C3 FE" (for "nop, retn, FE", FE is the rogue-byte).
Patch the "FE" byte and replace it by a NOP (0x90).
Define the new NOP as code.
As all the function having this rogue-bytes in it are undefined, I now need to define them as proper function.
The rogue-byte is indeed patch, but now I just need to find the address of "loc_410687".
How can I get this address within my IDAPython script?
(I specify that not all of the function that contains the rogue-byte start by those 3 xors, that's a coincidence. So I can't look for them in order to get the start of the function.)