Removing Obfuscation

[Git]

I ended up using a script to use by hand. Put cursor at first of the 2 bad jumps and hit alt-F9 to run the script. It nops the 5 bad positions, makes a block of code Unknown and then makes it code from the first address. :

#include <idc.idc>

static main()
{
   auto i,j,from,size, addr1; 

  addr1 = ScreenEA();

  if(addr1==BADADDR)
  {
     Message("Bad address");
     Exit();
  }
  
  for ( i=addr1; i<addr1+5; i++ ) 
  { 
      PatchByte(i, 0x90);
  }
     
  MakeUnknown(addr1, 10, DOUNK_DELNAMES);
  MakeCode(addr1);
  
  Message("\n" + "OK\n");
 }

For obsfuscation nonsense blocks with a different size to 5 bytes, I used a script that NOP's the selected block :

#include <idc.idc>

static main()
{
   auto i,j,from,size, addr1, addr2; 

  addr1 = SelStart();
  addr2 = SelEnd();
  
  if(addr1==BADADDR || addr2==BADADDR)
  {
     Warning("No area selected");
     Exit();
  }
  
  for ( i=addr1; i<addr2; i++ ) 
  { 
      PatchByte(i, 0x90);
  }

  if(Name(addr2+1) != "")
     MakeNameEx(addr2+1, "", SN_PUBLIC);
     
  MakeUnknown(addr1, addr2-addr1+6, DOUNK_DELNAMES);
  MakeCode(addr1);
  
  Message("\n" + "OK\n");
 }

I guess it would be fairly easy to extend the script to detect all nonsense jump pairs and do the whole file with one script run, but false hits worry me.

Git