0

I've disassembled and run auto-analysis on a .so file from an Android apk, and then hooked up the remote ARM debugger to an emulator. IDA then asked me if /data/app/com.package.name/lib/arm/libil2cpp.so is the same file as libil2cpp.so on my computer, which it is so I said yes. It took a few minutes to "move database", "move functions", etc. and now it's taking hours to perform auto-analysis all over again on the mapped files.

Is there any way to speed this up, and will it happen every time I start a remote debugging session?

Follow-up question: I learned that this is caused by IDA rebasing the program every time. Why can't it just use offsets from the start of the program and avoid rerunning the static analysis?

  • Isn't it because of rebasing? What version of IDA do you use? – MazeGen Jul 16 '19 at 21:02
  • Yeah it is... I'm using 32-bit IDA Pro 7.0.170914. – Akababa Jul 17 '19 at 2:06
  • 1
    I didn't try it but with IDA 7.3 the rebasing should be much faster: hex-rays.com/products/ida/7.3/index.shtml – MazeGen Jul 17 '19 at 8:58
0

I can confirm that the rebasing is much faster with IDA 7.4, and it seems to be addressed in version 7.3:

Another debugger related news is fast rebasing. Due to widespread use of ASLR, processes get loaded into a new address every time and IDA needs to adjust the database: move all segments to the addresses that the operating system assigned to them. This was a slow process that could take literally hours for big databases.

In IDA 7.3 we implemented another approach for rebasing which is up to 40 times faster and usually takes only a matter of seconds. You no longer have an excuse to take a coffee break every time you start a new debugging session. This makes our debuggers even more pleasant to use 😉

However, I can't answer the follow-up question.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.