18

I am working on an obfuscated binary. IDA did pretty good job distinguishing code from junk. However, I had started messing around with a function changing from code to data and vice versa and completely messed the function up and destroyed the way it looked like. I don't want to start new database on the executable and re-do all my work.

Is there a way to re-analyse a single function and return it to the way it looked like after initial analysis?

Improve this question
7
  • 4
    You can highlight the entire function, U to undefine it, C to mark it as code, P to mark it as a function.
    – DCoder
    Jun 21, 2013 at 4:22
  • Please dont add "Thank you" to the end of your questions. It does not add any information relevant to the post and is frowned upon across the entire Network. Any thanking that needs to done should be done via voting and marking answers correct (or via comments). Thanks! :)
    – asheeshr
    Jun 21, 2013 at 7:56
  • 2
    Time-saving tip: You can just use U and P; no need to use C if you're going to use P anyway.
    – Jason Geffner
    Jun 21, 2013 at 15:30
  • @JasonGeffner Doing P directly failed for me with "Command MakeFunction failed" error. However, U, C, Alt+P worked just fine.
    – PSS
    Jun 24, 2013 at 12:57
  • Interesting. I've never had that problem with highlighting the code, undefining (U), then highlighting the undefined bytes and pressing (P). Glad you got it working with C, though!
    – Jason Geffner
    Jun 24, 2013 at 14:36

1 Answer 1

Reset to default
21

Well you have to first Undefine the code using U key and they select the code and right click you will have some options like C (code) and so on. IDA almost give you ability of doing anything wih obfuscated code to help you to understand code correctly.

Addendum After converting to C (code), do Alt+P to create/edit function. In addition, rebuild layout graph by go to Layout view, right clicking empty space and selecting "Layout graph".

Improve this answer
0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.