I have undefined a block of code and I want to manually reconstruct this block by iterating over the area while decoding undefined bytes and calling idc.MakeCode for each instruction separately.I have disabled auto-analysis, but calling MakeCode on the head of the block causes the entire block to be converted to code. I can't find anything in IDA Python / IDC to do this that isn't a hook. Is there an analysis flag I need to set in order to prevent this behavior?
How can I call IDA Pro's MakeCode for one instruction at a time?
ida;idapython;idapro plugins;idapro sdk
This is a bit of a tricky question, because technically MakeCode is not what causing the rest of the code to be analyzed as code. A hint for that can be the fact that MakeCode actually returns the length of the current instruction. It is only later that additional following bytes are being converted to code (if possible).Thing is, that for IDA to do what IDA is good at (that is, successfully disassembling large code bases) it has it's own background code analyzer. That Code Analyzer is in charge of orchestrating high level disassembly operations such as figuring out where functions start, make sure all functions are analyzed, handle overlapping code to the best of it's ability, etc...One of the features of IDA's Code Analyzer is the code analysis stack. That stack contains leads to additional unexplored code and hints towards where additional assembly code might be found. While idc.MakeCode indeed only converts a single instruction to code, it registers the end of that instruction with the Code Analyzer, which then proceeds to analyze and convert the rest of the binary to code (as long as valid instructions are found).To disable the auto analysis running in the background hit the Options menu and the General function in it. In the dialog select the Analysis tab and uncheck the checkbox labeled Enabled to the left, as shown in the following pictureFun fact: You can call idaapi.analyzer_options() to show that dialog. You'll still need to uncheck the checkbox and hit the Ok button. Unfortunately it seems there's no API for that.