I'm currently working on an IDAPython script that aims to remove various rogue-byte from the malware that I'm reversing.

I'm in a case where some portions of my code contain this type of anti-disassembly trick: enter image description here

The fact is that without patching the rogue byte, I can't define this undefined blob as a proper function (P shortcut).

So the script is basically doing this:

  • Find the following opcode: "90 C3 FE" (for "nop, retn, FE", FE is the rogue-byte).

  • Patch the "FE" byte and replace it by a NOP (0x90).

  • Define the new NOP as code.

As all the function having this rogue-bytes in it are undefined, I now need to define them as proper function.

But I don't know how to go back to the address of the beginning of the undefined function. For instance, that's the result after executing my IDAPython script: enter image description here

The rogue-byte is indeed patch, but now I just need to find the address of "loc_410687".

How can I get this address within my IDAPython script?

(I specify that not all of the function that contains the rogue-byte start by those 3 xors, that's a coincidence. So I can't look for them in order to get the start of the function.)

Any idea?


  • That's the PonyLoader btw. for which the source got leaked: github.com/nyx0/Pony/blob/master/source/PonySrc/Pony.asm Search for "AntiDisasmTrick" - at least in the sourcecode those 3 xors are fixed. Aug 3, 2019 at 7:42
  • Yeah, that's indeed a pony sample! That's amazing how you recognize it with only 20 instructions :) Thanks for the source code, it's really helping me
    – Guillaume
    Aug 3, 2019 at 20:45
  • Did you try to reanalyze program after all patching is done ?
    – w s
    Aug 4, 2019 at 10:30
  • Yes, I started the analysis even before the rogue-byte things, I'm just trying to make the code cleaner and more pleasant to look at ^^ It even work perfectly in a debugger, the rogue-byte are not affecting anything !
    – Guillaume
    Aug 4, 2019 at 13:12


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Browse other questions tagged or ask your own question.