How to print disassembly code with IDAPython when IDA doesn’t detect it as code

Question

I have a piece of malware for windows / x64 which is packed, so IDA only recognizes the unpacker routine as data. This is the aspect of the zone just after loading the binary in IDA:

I want to print the disassembly instruction in that zone, so I use this piece of IDAPython code:

cur_addr = 0x75014F
end_addr = cur_addr + 0x28
while cur_addr <= end_addr:     #For 0x28 bytes print instructions
    instr = idc.generate_disasm_line(cur_addr, idc.GENDSM_FORCE_CODE)
    print (f'\t+ {hex(cur_addr)} :\t {instr}')
    cur_addr = idc.next_head(cur_addr)

I have identified that 0x75014F has the unpacker. Then, for 0x28 bytes I want to print the pseudocode from this position. After executing that, the output is…

    + 0x75014f :     pop     r13

So, only one instruction is decoded. The reason is idc.next_head is pointing much farther than 0x28 form my interesting zone. I suppose that at the end of all the dq definitions.

Then, in IDA, I press “C” to convert the zone to code. This is the aspect in IDA now:

After that, the script works as expected and this is the real result:

    + 0x75014f :     pop     r13
    + 0x750151 :     jmp     short loc_750155
    + 0x750155 :     push    rbx
    + 0x750156 :     cmovb   ebx, [rsp+8Ch]
    + 0x75015e :     pop     rbx
    + 0x75015f :     rol     dword ptr [r13+4], 66h
    + 0x750164 :     jmp     short loc_750168
    + 0x750168 :     ror     dword ptr [r13+8], 0FDh
    + 0x75016d :     cmova   rsi, rsi
    + 0x750171 :     xor     dword ptr [r13+0Ch], 8A6B7B58h

My question is, how to force (with IDAPython) convert a data zone to code? It seems that idc.generate_disasm_line is not enough.

Thanks.

Note: This is part of a reverse me challenge. I needed to find all the call instructions and see the code at which they pointed. Knowing the disassembled code, I could discard irrelevant code (in, out, muls, divs…). Then, by visual inspection of the non-discarded code, I could find out the unpacker. As my IDAPython code was not working I needed to press "C" in IDA to check all the undiscarded routines. If it were working my job would have been easier.

Answer 1

Something like this should work:

import ida_auto
import ida_bytes

def EnsureCode(ea):
    if ida_bytes.is_data(ida_bytes.get_flags(ea)):
        ida_bytes.del_items(ea,ida_bytes.DELIT_EXPAND)
    ida_auto.auto_wait()
    if not ida_bytes.is_code(ida_bytes.get_flags(ea)):
        ida_auto.auto_make_code(ea)
    ida_auto.auto_wait()