So i am pretty new to IDA (64bit) / reverse engineering and i got a few questions. Currently i have IDA pro 7.5 on Windows 10.
First question: I am currently analysing a dumped (bypassed the anti debugger with a modified version of Scylla dumper) PE exe 64bit file wich is ca. 500MB (over 500K functions) for now straight 7 days and i dont think its getting to an end. (MetaPC and Intel 80x86, Manual load with imagebase 0)
IDA always loops at the same place (20K Functions / Unexplored Data), im assuming thats because of a StackCookie with a GS Check. The error list is big. I even tried to open a copy from the same dump but first unpack it with the Manual reconstruct unpacker, wich crashed with an error message bad index file. After that it looped at the same position.
Should i Undefine the part where IDA is looping, so atleast it can finish the Auto-Analysis? Or is there a way to force the analysis to finish? Im open for a completly diffrent solution.
My Hardware is pretty good, 32GB Ram M.2 2TB Samsung EVO i7 10700k boosted to 5GHZ etc.. but my IDA is only using 9% of my CPU and 1.5GB Ram. Is it possible to allow IDA to use more power? Do u have to slice the dump into diffrent segments and load it into seprate IDA's windows? so i can extend the memory footprint. Already closed all windows except the Output window.
If you need more Information im open to deliver. Thanks :)