14

I am working on an obfuscated binary. IDA did pretty good job distinguishing code from junk. However, I had started messing around with a function changing from code to data and vice versa and completely messed the function up and destroyed the way it looked like. I don't want to start new database on the executable and re-do all my work.

Is there a way to re-analyse a single function and return it to the way it looked like after initial analysis?

  • 4
    You can highlight the entire function, U to undefine it, C to mark it as code, P to mark it as a function. – DCoder Jun 21 '13 at 4:22
  • Please dont add "Thank you" to the end of your questions. It does not add any information relevant to the post and is frowned upon across the entire Network. Any thanking that needs to done should be done via voting and marking answers correct (or via comments). Thanks! :) – asheeshr Jun 21 '13 at 7:56
  • 2
    Time-saving tip: You can just use U and P; no need to use C if you're going to use P anyway. – Jason Geffner Jun 21 '13 at 15:30
  • @JasonGeffner Doing P directly failed for me with "Command MakeFunction failed" error. However, U, C, Alt+P worked just fine. – PSS Jun 24 '13 at 12:57
  • Interesting. I've never had that problem with highlighting the code, undefining (U), then highlighting the undefined bytes and pressing (P). Glad you got it working with C, though! – Jason Geffner Jun 24 '13 at 14:36
19

Well you have to first Undefine the code using U key and they select the code and right click you will have some options like C (code) and so on. IDA almost give you ability of doing anything wih obfuscated code to help you to understand code correctly.

Addendum After converting to C (code), do Alt+P to create/edit function. In addition, rebuild layout graph by go to Layout view, right clicking empty space and selecting "Layout graph".

| improve this answer | |
  • 1
    I tried this but after redefining the function IDA remembered my modifications for variable types and names – Arthur.V Aug 24 at 10:32

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.