18

I am working on an obfuscated binary. IDA did pretty good job distinguishing code from junk. However, I had started messing around with a function changing from code to data and vice versa and completely messed the function up and destroyed the way it looked like. I don't want to start new database on the executable and re-do all my work.

Is there a way to re-analyse a single function and return it to the way it looked like after initial analysis?

asheeshr
  • 2,465
  • 8
  • 28
  • 41
PSS
  • 3,088
  • 1
  • 21
  • 35
  • 5
    You can highlight the entire function, U to undefine it, C to mark it as code, P to mark it as a function. – DCoder Jun 21 '13 at 04:22
  • Please dont add "Thank you" to the end of your questions. It does not add any information relevant to the post and is frowned upon across the entire Network. Any thanking that needs to done should be done via voting and marking answers correct (or via comments). Thanks! :) – asheeshr Jun 21 '13 at 07:56
  • 2
    Time-saving tip: You can just use U and P; no need to use C if you're going to use P anyway. – Jason Geffner Jun 21 '13 at 15:30
  • @JasonGeffner Doing P directly failed for me with "Command MakeFunction failed" error. However, U, C, Alt+P worked just fine. – PSS Jun 24 '13 at 12:57
  • Interesting. I've never had that problem with highlighting the code, undefining (U), then highlighting the undefined bytes and pressing (P). Glad you got it working with C, though! – Jason Geffner Jun 24 '13 at 14:36
  • @JasonGeffner. I did U, C and then had to do Alt+P do define the function. – PSS Jun 24 '13 at 15:40
  • @PSS Alt+P is for editing a function. Maybe you hadn't completely undefined (U<) everything inside of where the function would become. – Jonathon Reinhart Jun 28 '13 at 05:52

1 Answers1

21

Well you have to first Undefine the code using U key and they select the code and right click you will have some options like C (code) and so on. IDA almost give you ability of doing anything wih obfuscated code to help you to understand code correctly.

Addendum After converting to C (code), do Alt+P to create/edit function. In addition, rebuild layout graph by go to Layout view, right clicking empty space and selecting "Layout graph".

evandrix
  • 125
  • 1
  • 4
n00b
  • 581
  • 5
  • 5