# Point-to analysis of IDA Pro

I am aware that many users on this forum are experts (developers) of IDA Pro. So I am tentatively inquiring some high-level ideas behind the point-to analysis of IDA Pro.

According to my personal experience (I have been using IDA Pro 6.95 a lot for my binary code research), the point-to analysis implemented in IDA Pro is neither sound or complete. I am envisioning some heuristics are utilized to infer the value set in the code and data pointers.

So here is my question:

1. Could anyone shed a light on the point-to algorithm in IDA-Pro? I understood IDA-Pro is a commercial software so a high-level idea would be very much appreciated.

2. What is the best practice to build a call graph with IDA Pro, considering we have decent amount of indirect calls which needs to be interred.

The analysis platform could be ELF binaries on ARM, which seems relatively easier, comparing to x86.

• BTW: please let me know if it was more proper, to post this question in the IDA-Pro internal forum, thanks. Oct 10, 2018 at 10:03
• what exactly is a "point-to analysis"? some definition could be useful for those unfamiliar with the term, and maybe some samples of what you mean by it being "neither sound or complete"? Oct 10, 2018 at 19:49
• Hi @IgorSkochinsky , thanks for the note. So basically the "point-to" analysis I mentioned, tries to infer the possible value in a pointer. For instance we have a indirect call `call *eax`, then by somehow infer the `eax` could contain two possible value `0x8040204` and `0x8060208`, we know how to construct the call graph edge at this call site. Oct 11, 2018 at 7:19
• wikiwand.com/en/Pointer_analysis While `point-to` analysis can analyze both code and data pointers, I am talking about the code pointers, pointer that point to certain functions and those functions will be indirected called Oct 11, 2018 at 7:20
• The best way to how IDA does something: use IDA to reverse IDA. I mean it. I had to reverse IDA engine a lot in order to workaround various IDA bugs, and to understand how to implement the things I see in IDC via IDA SDK. Oct 11, 2018 at 8:44

The topic of pointer analysis is an important part of theoretical static analysis. Many articles and academic publications have been written about pointer analysis, this is a heavily researched field.

Besides the theoretical research, it is often an difficult issue to address even by skilled and trained reverse engineers. In certain cases it can be nearly impossible to retrieve the pointer without executing or emulating the relevant code.

Therefore, for IDA Pro to provide a "sound and complete" solution, as you put it, is not a trivial task. This is highlighted by the fact this isn't really the disassembler's task.

1. Could anyone shed a light on the point-to algorithm in IDA-Pro? I understood IDA-Pro is a commercial software so a high-level idea would be very much appreciated.

As far as I'm aware, IDA's pointer analysis is quite basic. Register calls are only resolved if they're directly assigned and there's isn't a lot of taint analysis. It is important to remember IDA is not a binary static analysis tool, IDA is a disassembler (and a decompiler). Taint analysis, constraint solving, call graph analysis etc are usually better done by tools designed specifically for those purposes. Having said that, IDA does make an effort to include heuristics to help with that type of thing.

1. What is the best practice to build a call graph with IDA Pro, considering we have decent amount of indirect calls which needs to be interred.

So again, IDA isn't the best tool to build a call graph if you're mostly focused on those cases where call targets are difficult to resolve or there are plenty of constraints to consider.

There are better tools for static binary analysis, as well as several questions about the topic here over RE.SO. My personal favorite is probably angr.

I suggest you spend time researching the theoretical topic and available tools and approaches before going forward.

• Sorry it couldn't be the answer you were looking for Oct 16, 2018 at 8:05
• @Nirlzr. I am looking for some more principled descriptions on IDA-Pro's point-to analysis. But I am afraid if it really exists, considering it is a close-source commercial tool. ASAICS, yes, it is just some heuristics, "Register calls are only resolved if they're directly assigned and there's isn't a lot of taint analysis. ". I agree with you. Oct 16, 2018 at 13:58