Improving IDA analysis

For a typical MS Windows executable IDA does quite good job of recognizing code and creating functions and usually the result is eye-pleasing and easy to decipher. The analysis is quite good but not perfect – there are cases when it takes data for code or wrongly determines the function boundaries.

The good news are that there are easy methods to improve the situation.

Continue reading Improving IDA analysis

IDA graph mode

The new IDA Pro introduces the graph mode. The disassembly of the current function is displayed as a graph: each basic block is represented as a node and cross references are represented as edges. It is easy to zoom, move, and modify the graph using the mouse, I’m sure you will just use the new interface without much difficulty. However, there are some unexpected commands which may render your life easier.
For example, the keyboard arrows can be used to move around the graph. This is something expected. But if you hold the Ctrl arrow and press the Up or Down keys, IDA will display the list of all predecessors or successors of the current node.
Double clicking on an edge with the Ctrl key pressed will jump to its destination. Alt will jump to its source.
Pressing ‘5’ on the keypad will center the current node. If you prefer to use the mouse, try to click with the mouse wheel on a node – the clicked node will be centered.
There are many tricks like this. All this is described in minute detail in the help. It won’t take long to read the graph-related pages and you will become really fast and comfortable with the graph view. I urge you to spend some 10-15 minutes reading it and playing with graphs.
IDA has more graph layout algorithms than you might think. See some of them in Dennis’ blog. You can create your own layouts too (and even your own graphs of absolutely anything). Just take a look at the sample plugin in the SDK.