15

I am working on an obfuscated binary. IDA did pretty good job distinguishing code from junk. However, I had started messing around with a function changing from code to data and vice versa and completely messed the function up and destroyed the way it looked like. I don't want to start new database on the executable and re-do all my work.

Is there a way to re-analyse a single function and return it to the way it looked like after initial analysis?

7
  • 4
    You can highlight the entire function, U to undefine it, C to mark it as code, P to mark it as a function.
    – DCoder
    Jun 21 '13 at 4:22
  • Please dont add "Thank you" to the end of your questions. It does not add any information relevant to the post and is frowned upon across the entire Network. Any thanking that needs to done should be done via voting and marking answers correct (or via comments). Thanks! :)
    – asheeshr
    Jun 21 '13 at 7:56
  • 2
    Time-saving tip: You can just use U and P; no need to use C if you're going to use P anyway. Jun 21 '13 at 15:30
  • @JasonGeffner Doing P directly failed for me with "Command MakeFunction failed" error. However, U, C, Alt+P worked just fine.
    – PSS
    Jun 24 '13 at 12:57
  • Interesting. I've never had that problem with highlighting the code, undefining (U), then highlighting the undefined bytes and pressing (P). Glad you got it working with C, though! Jun 24 '13 at 14:36
20

Well you have to first Undefine the code using U key and they select the code and right click you will have some options like C (code) and so on. IDA almost give you ability of doing anything wih obfuscated code to help you to understand code correctly.

Addendum After converting to C (code), do Alt+P to create/edit function. In addition, rebuild layout graph by go to Layout view, right clicking empty space and selecting "Layout graph".

0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.