1

I've disassembled and run auto-analysis on a .so file from an Android apk, and then hooked up the remote ARM debugger to an emulator. IDA then asked me if /data/app/com.package.name/lib/arm/libil2cpp.so is the same file as libil2cpp.so on my computer, which it is so I said yes. It took a few minutes to "move database", "move functions", etc. and now it's taking hours to perform auto-analysis all over again on the mapped files.

Is there any way to speed this up, and will it happen every time I start a remote debugging session?

Follow-up question: I learned that this is caused by IDA rebasing the program every time. Why can't it just use offsets from the start of the program and avoid rerunning the static analysis?

Improve this question
3
  • Isn't it because of rebasing? What version of IDA do you use?
    – MazeGen
    Jul 16, 2019 at 21:02
  • Yeah it is... I'm using 32-bit IDA Pro 7.0.170914.
    – Akababa
    Jul 17, 2019 at 2:06
  • 1
    I didn't try it but with IDA 7.3 the rebasing should be much faster: hex-rays.com/products/ida/7.3/index.shtml
    – MazeGen
    Jul 17, 2019 at 8:58

1 Answer 1

Reset to default
1

I can confirm that the rebasing is much faster with IDA 7.4, and it seems to be addressed in version 7.3:

Another debugger related news is fast rebasing. Due to widespread use of ASLR, processes get loaded into a new address every time and IDA needs to adjust the database: move all segments to the addresses that the operating system assigned to them. This was a slow process that could take literally hours for big databases.

In IDA 7.3 we implemented another approach for rebasing which is up to 40 times faster and usually takes only a matter of seconds. You no longer have an excuse to take a coffee break every time you start a new debugging session. This makes our debuggers even more pleasant to use 😉

However, I can't answer the follow-up question.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.