8

I made IDA load an ~70MB executable, and it's been analyzing it for about 16 hours now (still not finished, although it's over half done). While there is progress, the progress is very, very slow. On the other hand, a 5MB file is analyzed within about 5 minutes. I remember a 40MB executable taking about 30-40 minutes to analyze, but this is nothing compared to >16 hours.

Hopper took about 2 hours (and used 6GB of RAM!) to analyze the same file, but it managed to complete it. After looking at the disassembly, it seems that the executable in question tends to use many function pointers (over directly invoking functions)

Is this normal? Is there anything I can do to speed up the process?

5
  • 1
    This sounds to me like IDA needs more than the available RAM, and the OS starts paging parts of your process in and out, which generally delays things tremendously. Check your appropriate system tools (resmon/task manager in windows, top/vmstat in linux) for the amount of available/memory and disk activity. And ofc, make sure you're using the 64 bit version of IDA. Commented Apr 19, 2016 at 22:16
  • 1
    It's using ~9% of my RAM, so, less than a GB :) I actually had both Hopper and IDA running at the same time, and Hopper was the huge RAM hog (it's not running now though)! It's running on one core, and very few other processes are taking up extra CPU, so I don't think it's a resources issue :) And yes, I'm using the 64-bit version of IDA (the executable in question is 64-bit as well)
    – MiJyn
    Commented Apr 20, 2016 at 1:14
  • I encountered such a problems when my idb was stored on a network disk. Hope that it's not your case.
    – w s
    Commented Apr 20, 2016 at 6:58
  • @ws Oh yes, that would probably be a pretty big issue, because it seems like as if it loads the idb dynamically (and doesn't just store the entire file in RAM). But no, this is all on my local HDD :)
    – MiJyn
    Commented Apr 20, 2016 at 7:00
  • since its 64-bit file (I its assume PE32+) try ArkDasm disassembler it has small memory footprint and the same shortcuts as IDA - www.arkdasm.com
    – MaxQ
    Commented Apr 22, 2016 at 21:46

1 Answer 1

14

There are some tricks you can use to speed up the process.

IDA's Functions window, as well as some other windows, presents sorted data. This means that for every function added, it sorts the entire view. When operating on >100k functions, this can take a considerable (>1sec) amount of time. So if you have ~200K functions, the analysis will take forever, more or less.

I highly recommend closing (hiding is not enough) all views except the Output window. This should speed things up quite a bit.

Regarding the RAM, being a 32bit application, IDA can only take up up to about 3GB of memory. From my experience, it handles 100MB binaries well.

4
  • I think it did help the speed slightly, thank you! Each refresh in the status window is maybe half? a second, maybe a third, but it seems to be less than 16 bytes. Then again, I recall there being many, many small functions, about 5 instructions long, or less (in fact, the pictogram on IDA is entirely blue! minus the beige data, and the grey/black, of course)
    – MiJyn
    Commented Apr 20, 2016 at 6:26
  • Just to clarify though, this doesn't answer the question, because although I think it did make a bit of a difference, it's still very slow. I believe that the status window at the bottom is refreshing much faster now, sometimes even goes to ~30-50 bytes, but this is still too slow haha
    – MiJyn
    Commented Apr 20, 2016 at 6:58
  • Got a speedup of ~5x. Thank you!!!!
    – toster-cx
    Commented Mar 16, 2017 at 0:05
  • You're a live saver!! I can't believe IDA doesn't fix this...
    – Akababa
    Commented Jul 12, 2019 at 22:06

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.