2

How can I color functions that contain loops in IDApython ?

If the end of the basic block can jump to start of basic block it's good enough, even in the rare case this is not a loop. But how do i implement this ?

EDIT: This is not good cause the loop can span multiple basic blocks. Or, maybe if the ecx register is used ? I don't care if I have some false positives ?

  • Maybe searching for code xref where frm > to will find you already a narrow enough set of possible targets – Willem Hengeveld Sep 4 '14 at 22:05
  • 1
    You may find this quesion useful. It is about finding recursive calls using IDA. Both answers are awesome. – Ta Thanh Dinh Sep 5 '14 at 15:48
7

There is an IDA plugin called Loop Detection that does that, it comes with source code and a paper explaining how it works. Have a look at loop_detection.cpp and refer to the paper for an explanation of how it works.

Plugin with source code : http://www.openrce.org/downloads/details/9/Loop_Detection Paper: http://www.uninformed.org/?v=1&a=2&t=pdf

Looking for uses of ecx is not a good approach as this register is often used for other purposes. A better approach is to look for back edges between blocks.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.