I know it is a very newbie question and sorry about that, but I can't really find any way how to make IDA analyze the code after the unpacking was done. What I mean is that when I unpack an exe and dump it to a new exe file (using another software, not IDA), and then load the unpacked exe in IDA, everything works fine (all the API calls are recognized etc). But when I load the unpacked exe in IDA and put a bp on OEP, I just finish with "unscanned" code and don't know how to ask IDA to scan it and recognize the API calls. Thank you in advance for any help and tips.
After you have finished unpacking the program and get to the OEP
File --> Plugins --> Universal Unpacker Manual Reconstruct
Fill in the info if its not correct :)
Ok, edit for free version:
Heres what I have done to get the program re-analyzed:
UPX packed notepad.exe (easy to unpack)
loaded packed file into freshly installed IDA Pro Free 5.0
unpacked via debugger till got to OEP
Once unpacked click: Debugger --> Take memory snapshot --> All memory?(maybe not all is needed, i used all, as i wanted to see if it would work)
Go to OEP and pressed "c" to create some of the code
Options-->General-->Analysis-->Reanalyze program (As suggested above)
Wait forever to reanalyze
OEP is of course not recognized, but the unpacking is done and some? / all? of the code is recognized by IDA.
probably not the best way to do it, but free edition seems a bit limited. probably best do it via olly and load a dump into ida. :(