2

I have a piece of malware for windows / x64 which is packed, so IDA only recognizes the unpacker routine as data. This is the aspect of the zone just after loading the binary in IDA:

Section of undetected code

I want to print the disassembly instruction in that zone, so I use this piece of IDAPython code:

cur_addr = 0x75014F
end_addr = cur_addr + 0x28
while cur_addr <= end_addr:     #For 0x28 bytes print instructions
    instr = idc.generate_disasm_line(cur_addr, idc.GENDSM_FORCE_CODE)
    print (f'\t+ {hex(cur_addr)} :\t {instr}')
    cur_addr = idc.next_head(cur_addr)

I have identified that 0x75014F has the unpacker. Then, for 0x28 bytes I want to print the pseudocode from this position. After executing that, the output is…

    + 0x75014f :     pop     r13

So, only one instruction is decoded. The reason is idc.next_head is pointing much farther than 0x28 form my interesting zone. I suppose that at the end of all the dq definitions.

Then, in IDA, I press “C” to convert the zone to code. This is the aspect in IDA now:

Section of code of interest

After that, the script works as expected and this is the real result:

    + 0x75014f :     pop     r13
    + 0x750151 :     jmp     short loc_750155
    + 0x750155 :     push    rbx
    + 0x750156 :     cmovb   ebx, [rsp+8Ch]
    + 0x75015e :     pop     rbx
    + 0x75015f :     rol     dword ptr [r13+4], 66h
    + 0x750164 :     jmp     short loc_750168
    + 0x750168 :     ror     dword ptr [r13+8], 0FDh
    + 0x75016d :     cmova   rsi, rsi
    + 0x750171 :     xor     dword ptr [r13+0Ch], 8A6B7B58h

My question is, how to force (with IDAPython) convert a data zone to code? It seems that idc.generate_disasm_line is not enough.

Thanks.

Note: This is part of a reverse me challenge. I needed to find all the call instructions and see the code at which they pointed. Knowing the disassembled code, I could discard irrelevant code (in, out, muls, divs…). Then, by visual inspection of the non-discarded code, I could find out the unpacker. As my IDAPython code was not working I needed to press "C" in IDA to check all the undiscarded routines. If it were working my job would have been easier.

1 Answer 1

2

Something like this should work:

import ida_auto
import ida_bytes

def EnsureCode(ea):
    if ida_bytes.is_data(ida_bytes.get_flags(ea)):
        ida_bytes.del_items(ea,ida_bytes.DELIT_EXPAND)
    ida_auto.auto_wait()
    if not ida_bytes.is_code(ida_bytes.get_flags(ea)):
        ida_auto.auto_make_code(ea)
    ida_auto.auto_wait()
1
  • Dear @Rolf Rolles. Your code helped me, but I wanted to elaborate a well informed comment. Mar 11, 2022 at 12:24

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.