3

I am aware that many users on this forum are experts (developers) of IDA Pro. So I am tentatively inquiring some high-level ideas behind the point-to analysis of IDA Pro.

According to my personal experience (I have been using IDA Pro 6.95 a lot for my binary code research), the point-to analysis implemented in IDA Pro is neither sound or complete. I am envisioning some heuristics are utilized to infer the value set in the code and data pointers.

So here is my question:

  1. Could anyone shed a light on the point-to algorithm in IDA-Pro? I understood IDA-Pro is a commercial software so a high-level idea would be very much appreciated.

  2. What is the best practice to build a call graph with IDA Pro, considering we have decent amount of indirect calls which needs to be interred.

The analysis platform could be ELF binaries on ARM, which seems relatively easier, comparing to x86.

Improve this question
7
  • BTW: please let me know if it was more proper, to post this question in the IDA-Pro internal forum, thanks.
    – lllllllllllll
    Commented Oct 10, 2018 at 10:03
  • 1
    what exactly is a "point-to analysis"? some definition could be useful for those unfamiliar with the term, and maybe some samples of what you mean by it being "neither sound or complete"?
    – Igor Skochinsky ♦
    Commented Oct 10, 2018 at 19:49
  • Hi @IgorSkochinsky , thanks for the note. So basically the "point-to" analysis I mentioned, tries to infer the possible value in a pointer. For instance we have a indirect call call *eax, then by somehow infer the eax could contain two possible value 0x8040204 and 0x8060208, we know how to construct the call graph edge at this call site.
    – lllllllllllll
    Commented Oct 11, 2018 at 7:19
  • wikiwand.com/en/Pointer_analysis While point-to analysis can analyze both code and data pointers, I am talking about the code pointers, pointer that point to certain functions and those functions will be indirected called
    – lllllllllllll
    Commented Oct 11, 2018 at 7:20
  • 2
    The best way to how IDA does something: use IDA to reverse IDA. I mean it. I had to reverse IDA engine a lot in order to workaround various IDA bugs, and to understand how to implement the things I see in IDC via IDA SDK.
    – Anton Kukoba
    Commented Oct 11, 2018 at 8:44

1 Answer 1

Reset to default
3
+100

The topic of pointer analysis is an important part of theoretical static analysis. Many articles and academic publications have been written about pointer analysis, this is a heavily researched field.

Besides the theoretical research, it is often an difficult issue to address even by skilled and trained reverse engineers. In certain cases it can be nearly impossible to retrieve the pointer without executing or emulating the relevant code.

Therefore, for IDA Pro to provide a "sound and complete" solution, as you put it, is not a trivial task. This is highlighted by the fact this isn't really the disassembler's task.

As for your specific questions:

  1. Could anyone shed a light on the point-to algorithm in IDA-Pro? I understood IDA-Pro is a commercial software so a high-level idea would be very much appreciated.

As far as I'm aware, IDA's pointer analysis is quite basic. Register calls are only resolved if they're directly assigned and there's isn't a lot of taint analysis. It is important to remember IDA is not a binary static analysis tool, IDA is a disassembler (and a decompiler). Taint analysis, constraint solving, call graph analysis etc are usually better done by tools designed specifically for those purposes. Having said that, IDA does make an effort to include heuristics to help with that type of thing.

  1. What is the best practice to build a call graph with IDA Pro, considering we have decent amount of indirect calls which needs to be interred.

So again, IDA isn't the best tool to build a call graph if you're mostly focused on those cases where call targets are difficult to resolve or there are plenty of constraints to consider.

There are better tools for static binary analysis, as well as several questions about the topic here over RE.SO. My personal favorite is probably angr.

I suggest you spend time researching the theoretical topic and available tools and approaches before going forward.

Improve this answer
2
  • Sorry it couldn't be the answer you were looking for
    – NirIzr
    Commented Oct 16, 2018 at 8:05
  • 1
    @Nirlzr. I am looking for some more principled descriptions on IDA-Pro's point-to analysis. But I am afraid if it really exists, considering it is a close-source commercial tool. ASAICS, yes, it is just some heuristics, "Register calls are only resolved if they're directly assigned and there's isn't a lot of taint analysis. ". I agree with you.
    – lllllllllllll
    Commented Oct 16, 2018 at 13:58

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.