📚 OpenRCE is preserved as a read-only archive. Launched at RECon Montreal in 2005. Registration and posting are disabled.








Flag: Tornado! Hurricane!

 Forums >>  IDA Pro  >>  Faster function recognizion in IDA, automatically?

Topic created on: June 11, 2006 03:21 CDT by milman .

Hey,

I've examined IDA-Pro, to see if it feets my needs.

I need to find the functions in banch of files, and to do some process on them, however I encountered several problems:
1. it can take lot of time (an hour or more) for big files
2. when running in batch mode (or even on normal work), IDA-PRO sometimes get stack with an error "too many stack points".
3. not all functions are being recognized.

I try varios solutions:
For the 1st problem, I tryed to remove certain option from the auto analysis, but it caused to poor funtions recognizion.

for the second, I switched from ver 4.9 to 4.7, and it seems to stop those errors. I think I also had the error in ver 5.0, but I don't remember right now.

The 3rd problem - I guess it's the way IDA work, and it didn't recognize a function because there was no use of this function, and in other file it did, because, I guess, there use a use of that function. If so, I can live with that.

I'm sorry for this long message, but I'd really like to hear  commets from your experience, tricks to make IDA Pro faster, solutions for reliable work in batch mode (it must not stack), or even alternative tools that can do the job.

Thanks,

        Milman.

  pedram     June 11, 2006 18:46.14 CDT
This is an interesting problem and one that I'd definetely like to hear other people's opinions on. Not too long ago I read an academic white paper on improving the function detection capabilities within IDA ... for the life of me I can't find it now. I may have a printed copy on my desk at work and will check tomorrow.

OllyDbg's disassembly engine has function enumeration support, have you looked at building something around that?

  drew     June 11, 2006 22:31.43 CDT
Analyzing large files can take a while with IDA.  As Pedram mentioned OllyDbg's analysis is much faster.  On a 5 MB binary with 20k functions IDA would take a couple hours.  OllyDbg would analyze it in a matter of minutes.  However, using OllyDbg's analysis will likely result in fewer functions being recognized.

  Faithless     June 12, 2006 03:14.12 CDT
Alexander Sotirov had some points about IDA function detection in his CanSEC 06 presentation Reverse Engineering Microsoft Binaries. Interesting read at how a large scale MS patch analysis workgroup goes about solving some of the scale problems.

Part of the problem stems from IDA trying to dissamble data as code. There's a IDA .PDB plugin that attempts to resolve some of these problems, but of course it requires you to have access to .DBG or Symbols for the file you're looking at.

Alex posts under asotirov here at OpenRCE, hopefully he can add some suggestions or advice on better function detection tweaks in IDA.

  milman   June 14, 2006 09:35.16 CDT
thanks for the replies!

I wasn't aware of OllyDbg. It may be a solution, and I'll check that later. However, since IDA is very mature and popular, it's more likely to be supported and developed, incluidng different architectures. Right now I'm interesting in Windows binaries, but that might change.

I've read Sotirov's article couple of weeks ago, and played around with his plugin for IDA, but I wasn't satesfied with the results, because it took more time, and I didn't have Symbols for the files I needed to work on.

I think the main problem I see, is to trust IDA to do the work, and not to fail. Right now I'm using it's automatic anlysis, and if there is an error from some reason, I can't really know about it.

A solution will be to write a plugin of my own, which will do the analysis process, and will know to handle errors. IDA don't reveal how they do their analysis exacly, and I don't know if it's possible to write a plugin that extend the IDA to my needs: open and analyse files, and doing process on it, without reload of IDA each time. If someone have experienc with it, I'll be happy to hear.


Thanks,

      Uri.

  pedram     June 14, 2006 10:00.50 CDT
If you have an x64 (PE32+) copy of your target binary, you should look into the latest article from Skape on Improving Automated Analysis of Windows x64 Binaries.


4.1) Exception Directory Enumeration
...

4.1.1) Functions

One of the most obvious uses for the information stored in the exception
directory is that it can be used to discover all of the non-leaf
functions in a binary.  This is cool because it works regardless of
whether or not you actually have symbols for the binary, thus providing
an easy technique for identifying the majority of the functions in a
binary.
...


With regards to how IDA does it's auto-analysis. I recall seeing a comment from Ilfak (probably on the IDA board) that stated Sotirov's slide on the algorithm (slide 33) was dead on.

Whatever solution you end up coming up with, please share back with the rest of OpenRCE. I for one am definetely interested.

Note: Registration is required to post to the forums.

There are 31,328 total registered users.


Recently Created Topics
[help] Unpacking VMP...
Mar/12
Reverse Engineering ...
Jul/06
let 'IDAPython' impo...
Sep/24
set 'IDAPython' as t...
Sep/24
GuessType return une...
Sep/20
About retrieving the...
Sep/07
How to find specific...
Aug/15
How to get data depe...
Jul/07
Identify RVA data in...
May/06
Question about memor...
Dec/12


Recent Forum Posts
Finding the procedur...
rolEYder
Question about debbu...
rolEYder
Identify RVA data in...
sohlow
let 'IDAPython' impo...
sohlow
How to find specific...
hackgreti
Problem with ollydbg
sh3dow
How can I write olly...
sh3dow
New LoadMAP plugin v...
mefisto...
Intel pin in loaded ...
djnemo
OOP_RE tool available?
Bl4ckm4n


Recent Blog Entries
halsten
Mar/14
Breaking IonCUBE VM

oleavr
Oct/24
Anatomy of a code tracer

hasherezade
Sep/24
IAT Patcher - new tool for ...

oleavr
Aug/27
CryptoShark: code tracer ba...

oleavr
Jun/25
Build a debugger in 5 minutes

More ...


Recent Blog Comments
nieo on:
Mar/22
IAT Patcher - new tool for ...

djnemo on:
Nov/17
Kernel debugger vs user mod...

acel on:
Nov/14
Kernel debugger vs user mod...

pedram on:
Dec/21
frida.github.io: scriptable...

capadleman on:
Jun/19
Using NtCreateThreadEx for ...

More ...


Imagery
SoySauce Blueprint
Jun 6, 2008

[+] expand

View Gallery (11) / Submit