1

I'm analyzing an obfuscated binary. IDA did a pretty good job of doing the initial auto-analysis. Later, I went through and marked some sections as undefined, or code, etc. Now IDA can't re-create a section as a function. It complains about

The function has undefined instruction/data at the specified address.

I think this is because it has remembered where I've marked thing as undefined or data or code. And those marks are confusing the auto analyzer.

Thanks!

1

No, IDA does not keep a separate list of addresses handled by the user.

Normally the message you quote should mention the address of the problem so you can double-click it to jump there and fix the issue (e.g. convert data to code). If there are many such places, you can also try a mass selection and force everything in a range to code (though this may backfire if code is obfuscated).

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.