I have a piece of malware for windows / x64 which is packed, so IDA only recognizes the unpacker routine as data. This is the aspect of the zone just after loading the binary in IDA:
I want to print the disassembly instruction in that zone, so I use this piece of IDAPython code:
cur_addr = 0x75014F
end_addr = cur_addr + 0x28
while cur_addr <= end_addr: #For 0x28 bytes print instructions
instr = idc.generate_disasm_line(cur_addr, idc.GENDSM_FORCE_CODE)
print (f'\t+ {hex(cur_addr)} :\t {instr}')
cur_addr = idc.next_head(cur_addr)
I have identified that 0x75014F
has the unpacker. Then, for 0x28
bytes I want to print the pseudocode from this position. After executing that, the output is…
+ 0x75014f : pop r13
So, only one instruction is decoded. The reason is idc.next_head
is pointing much farther than 0x28 form my interesting zone. I suppose that at the end of all the dq
definitions.
Then, in IDA, I press “C” to convert the zone to code. This is the aspect in IDA now:
After that, the script works as expected and this is the real result:
+ 0x75014f : pop r13
+ 0x750151 : jmp short loc_750155
+ 0x750155 : push rbx
+ 0x750156 : cmovb ebx, [rsp+8Ch]
+ 0x75015e : pop rbx
+ 0x75015f : rol dword ptr [r13+4], 66h
+ 0x750164 : jmp short loc_750168
+ 0x750168 : ror dword ptr [r13+8], 0FDh
+ 0x75016d : cmova rsi, rsi
+ 0x750171 : xor dword ptr [r13+0Ch], 8A6B7B58h
My question is, how to force (with IDAPython) convert a data zone to code? It seems that idc.generate_disasm_line
is not enough.
Thanks.
Note: This is part of a reverse me challenge. I needed to find all the call instructions and see the code at which they pointed. Knowing the disassembled code, I could discard irrelevant code (in, out, muls, divs…). Then, by visual inspection of the non-discarded code, I could find out the unpacker. As my IDAPython code was not working I needed to press "C" in IDA to check all the undiscarded routines. If it were working my job would have been easier.