0

So i am pretty new to IDA (64bit) / reverse engineering and i got a few questions. Currently i have IDA pro 7.5 on Windows 10.

First question: I am currently analysing a dumped (bypassed the anti debugger with a modified version of Scylla dumper) PE exe 64bit file wich is ca. 500MB (over 500K functions) for now straight 7 days and i dont think its getting to an end. (MetaPC and Intel 80x86, Manual load with imagebase 0)

IDA always loops at the same place (20K Functions / Unexplored Data), im assuming thats because of a StackCookie with a GS Check. The error list is big. I even tried to open a copy from the same dump but first unpack it with the Manual reconstruct unpacker, wich crashed with an error message bad index file. After that it looped at the same position.

Should i Undefine the part where IDA is looping, so atleast it can finish the Auto-Analysis? Or is there a way to force the analysis to finish? Im open for a completly diffrent solution.

Second question:

My Hardware is pretty good, 32GB Ram M.2 2TB Samsung EVO i7 10700k boosted to 5GHZ etc.. but my IDA is only using 9% of my CPU and 1.5GB Ram. Is it possible to allow IDA to use more power? Do u have to slice the dump into diffrent segments and load it into seprate IDA's windows? so i can extend the memory footprint. Already closed all windows except the Output window.

If you need more Information im open to deliver. Thanks :)

Improve this question

1 Answer 1

Reset to default
2

The first one sounds like a bug. First, update to 7.6 to see if the issue has been fixed there. If it hasn't, use Help->Report a bug or an issue to send the database to Hex-Rays so they can diagnose the issue. You're not going to get any sort of bug fix for 7.5 after 7.6 has been released.

As for the second one, no. Autoanalysis is currently still single-threaded AFAIK, meaning that the 9% CPU percentage being reported is just one of your cores being maxed out, and you can't make it use the others.

Improve this answer
1
  • 1
    Not necessarily a bug, I use IDA against 50-60mb executables regularly, and it really is quite slow. There's also a really bad (1-5 second) lag while jumping between locations in the assembly view. Otherwise, agreed obviously. I often glance longingly at cpubenchmark.net/singleThread.html and wish for a Ryzen.
    – Orwellophile
    Commented Jun 13, 2021 at 3:25

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.