1

Obfuscation techniques such as opaque predicates often trick IDA's auto-analysis into creating incorrect or contradicting interpretations of the code under analysis.

There is some mention of controlling IDA's auto-analysis via hooks on the IDA website, however I cannot find other references to this online.

In my case, I have a list of known-valid branches and I want IDA to "prefer" these branches during auto-analysis in order to avoid sp-analysis and invalid decompilation issues.

I have been able to essentially mimic this functionality by scripting my own analysis pass that ignores non- known-valid branches, but I wonder if there is an easier way.

0
+100

Last time I had that a problem like that, I loaded the executable with auto-analysis disabled, then ran a script that detected valid and invalid branches, and patched the valid branches to be non-conditional and nopped out the invalid branches. After that, I just enabled auto-analysis, and as the invalid branches were removed, the analysis results were fine.

Of course, this depends on being able to find the valid and invalid branch instructions, not just their targets. I am unsure what you mean by "a list of known-valid branches", but in case you know the location of the valid branch instructions, or you can write a simple analyzer that detects the patterns with invalid branches, a preprocessor might be a good way to handle the problem.

1

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.