I am aware that many users on this forum are experts (developers) of IDA Pro. So I am tentatively inquiring some high-level ideas behind the point-to analysis of IDA Pro.

According to my personal experience (I have been using IDA Pro 6.95 a lot for my binary code research), the point-to analysis implemented in IDA Pro is neither sound or complete. I am envisioning some heuristics are utilized to infer the value set in the code and data pointers.

So here is my question:

1. Could anyone shed some lights on the point-to algorithm in IDA-Pro? I understood IDA-Pro is a commercial software so a high-level idea would be very much appreciated.

2. What is the best practice to build a call graph with IDA Pro, considering we have decent amount of indirect calls which needs to be interred.

The analysis platform could be ELF binaries on ARM, which seems relatively easier, comparing to x86.

I am aware that many users on this forum are experts (developers) of IDA Pro. So I am tentatively inquiring some high-level ideas behind the point-to analysis of IDA Pro.

According to my personal experience (I have been using IDA Pro 6.95 a lot for my binary code research), the point-to analysis implemented in IDA Pro is neither sound or complete. I am envisioning some heuristics are utilized to infer the value set in the code and data pointers.

So here is my question:

1. Could anyone shed a light on the point-to algorithm in IDA-Pro? I understood IDA-Pro is a commercial software so a high-level idea would be very much appreciated.

2. What is the best practice to build a call graph with IDA Pro, considering we have decent amount of indirect calls which needs to be interred.

The analysis platform could be ELF binaries on ARM, which seems relatively easier, comparing to x86.