#include static main(void) { auto ea, ea_pusha, ea_popa, ea_call, count; ea = ScreenEA(); { ea_pusha = FindText(ea,SEARCH_DOWN|SEARCH_NEXT|SEARCH_CASE|SEARCH_REGEX, 0, 0, "pusha"); if ( ea_pusha == BADADDR ) return; Message("Found pusha at %x\n", ea_pusha); ea_popa = FindText(ea_pusha,SEARCH_DOWN|SEARCH_NEXT|SEARCH_CASE|SEARCH_REGEX, 0, 0, "popa"); if ( ea_popa == BADADDR ) return; Message("Found popa at %x\n", ea_popa); ea_call = FindText(ea_pusha,SEARCH_DOWN|SEARCH_NEXT|SEARCH_CASE|SEARCH_REGEX, 0, 0, "call"); Message("Found call at %x\n", ea_call); if ( ea_call != BADADDR ) { if ( ea_popa > ea_call ) { // Message("pusha = %x, call = %x, popa = %x\n", ea_pusha, ea_call, ea_popa); ea = ea_call; return; } } // IDA 4.7 used to hang when JMP jumped onto a hidden pusha. Use ea_pusha+1 or just ea_pusha accordingly. if ( HideArea(ea_pusha+1, ea_popa+1, "", "", "", -1) == 0 ) Message("HideArea failed between %x and %x\n", ea_pusha, ea_popa); ea = ea_pusha; } Message("Done hide_obf\n"); }