Using IDA, can I specify 2 Sub-Routines (really, it's 2 WINAPI calls) and have IDA create a "map" between the 2 points? I want to know all the possible branches the EIP can take from one instruction to another instruction.

I am using IDA-Pro 6.0 (or 6.1).

Thank you.

Edit - I can only use static analysis tools for this.

  • 2
  • Thank you for such a fast reply. I will look at this. I edited my question just now to include a detail about require a static analysis solution. – Lokked Nov 15 '17 at 19:03
  • Do you want to find a path between two functions ? – 0xec Nov 15 '17 at 19:27
  • That is correct, @0xec – Lokked Nov 15 '17 at 20:47
  • The solution in the post I linked to does not rely on dynamic analysis BTW. – Igor Skochinsky Nov 16 '17 at 13:47

You can use the alleycat plugin to find the path between two functions/basic blocks etc.


Finding the path between two functions http_init_main and http_parser_set_challenge in a mipsel elf.

  1. Go to View -> Find paths from current function to...

    enter image description here

  2. Select the target function.

    enter image description here

  3. Alleycat would display the path to reach the selected function from initial function. Additionally, the corresponding basic blocks would be highlighted in the graph view.

    enter image description here

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.