3

I know it is a very newbie question and sorry about that, but I can't really find any way how to make IDA analyze the code after the unpacking was done. What I mean is that when I unpack an exe and dump it to a new exe file (using another software, not IDA), and then load the unpacked exe in IDA, everything works fine (all the API calls are recognized etc). But when I load the unpacked exe in IDA and put a bp on OEP, I just finish with "unscanned" code and don't know how to ask IDA to scan it and recognize the API calls. Thank you in advance for any help and tips.

  • Did you try Options-->General-->Analysis-->Reanalyze program ? – w s Feb 16 '14 at 7:14
8

After you have finished unpacking the program and get to the OEP

File --> Plugins --> Universal Unpacker Manual Reconstruct

Fill in the info if its not correct :)

Ok, edit for free version:

Heres what I have done to get the program re-analyzed:

UPX packed notepad.exe (easy to unpack)

  • loaded packed file into freshly installed IDA Pro Free 5.0

  • unpacked via debugger till got to OEP

  • Once unpacked click: Debugger --> Take memory snapshot --> All memory?(maybe not all is needed, i used all, as i wanted to see if it would work)

  • Terminate process

  • Go to OEP and pressed "c" to create some of the code

  • Options-->General-->Analysis-->Reanalyze program (As suggested above)

  • Wait forever to reanalyze

  • OEP is of course not recognized, but the unpacking is done and some? / all? of the code is recognized by IDA.

    probably not the best way to do it, but free edition seems a bit limited. probably best do it via olly and load a dump into ida. :(

| improve this answer | |
  • Thanks for answer, that would definitely solve the problem if I had Ida Pro. So I guess there isn't any solution for Ida Pro Free? It's quite annoying, OllyDbg doesn't have any problems to comment the code after reaching the OEP, so why couldn't Ida automatically do this? Btw. I don't need any unpacking support/plugins, just would like to make Ida reanalyzing the code.. – Krzysztof Bracha Feb 15 '14 at 17:39
1

For me, just clicking

Options - General - Analysis - Reanalyze program

button solved problem.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.