How to force IDA to analyze a packed exe after the program has unpacked itself?

Question

I know it is a very newbie question and sorry about that, but I can't really find any way how to make IDA analyze the code after the unpacking was done. What I mean is that when I unpack an exe and dump it to a new exe file (using another software, not IDA), and then load the unpacked exe in IDA, everything works fine (all the API calls are recognized etc). But when I load the unpacked exe in IDA and put a bp on OEP, I just finish with "unscanned" code and don't know how to ask IDA to scan it and recognize the API calls. Thank you in advance for any help and tips.

Answer 1

After you have finished unpacking the program and get to the OEP

File --> Plugins --> Universal Unpacker Manual Reconstruct

Fill in the info if its not correct :)

Ok, edit for free version:

Heres what I have done to get the program re-analyzed:

UPX packed notepad.exe (easy to unpack)

• loaded packed file into freshly installed IDA Pro Free 5.0

• unpacked via debugger till got to OEP

• Once unpacked click: Debugger --> Take memory snapshot --> All memory?(maybe not all is needed, i used all, as i wanted to see if it would work)

• Terminate process

• Go to OEP and pressed "c" to create some of the code

• Options-->General-->Analysis-->Reanalyze program (As suggested above)

• Wait forever to reanalyze

• OEP is of course not recognized, but the unpacking is done and some? / all? of the code is recognized by IDA.

  probably not the best way to do it, but free edition seems a bit limited. probably best do it via olly and load a dump into ida. :(

Answer 2

For me, just clicking

Options - General - Analysis - Reanalyze program

button solved problem.