Extrarius
April 19th, 2006, 10:53
I'm thinking about buying it, but only if the latest version makes things far easier with extra features, so I'm wondering if it supports a few things that the freeware version doesnt (or how difficult it would be to add such things with plugins etc). If there is a more appropriate forum for such questions, I'd appreciate pointers to it (the IDA Pro forum is only for customers, so that wasn't an option).
I would test the demo version, but the programs I need to use it on take so long to analyse that it times out shortly after it allows user interaction (maybe 2-5 minutes, depending on whatever random factors it uses to decide when to shut down).
I'm having a difficult time keeping track of functions that were (probably) only in a single compilation unit, such that they freely use whatever registers they want as input. Does IDA Pro 5.0 allow marking registers as arguments to a function, such that each call to the function will mark the line setting that register with the parameter name and/or type?
Is there some way to have the analyzer treat a 'call' as if the function called was actually in place of the call? Several functions that were probably used only in a single compilation unit end up using the stack frame of the one or two functions that call them, and that messed up analysis such that I have to figure out all the offsets myself, which is quite tedious.
How well does it's stack analysis work? Several times in IDA freeware, the program apparently misses a push or pop and throws off the use of arguments in a function so that every single one is called incorrectly. This could perhaps be caused by it's signatures having the wrong calling convention, but it happens quite rarely so it seems more likely to simply be a bug of some sort.
How well does it recognize basic structures such as 'switch' statements? In OllyDbg, most are recognized in the project I'm currently working on and it helps tremendously, but IDA Freeware doesn't seem to recognize any at all.
Are there any plugins that attempt to detect where a function is inlined and somehow mark that as an xref to the function itself? If not, how difficult would it be to make something like that? Inline functions give me a headache since I have to go comment each instance after figuring out the non-inlined version and it can take quite a while.
Another thing that bothers me is the IDA website - it has some oddities, such as the menu along the bottom not being updated to match the top menu (the bottom one takes you to and outdated news page, for example). Does such negligence reflect on a larger issue, or is it just that a bunch of programmers are trying to make a website?
Any other comments or suggestions would be greatly appreciated
I would test the demo version, but the programs I need to use it on take so long to analyse that it times out shortly after it allows user interaction (maybe 2-5 minutes, depending on whatever random factors it uses to decide when to shut down).
I'm having a difficult time keeping track of functions that were (probably) only in a single compilation unit, such that they freely use whatever registers they want as input. Does IDA Pro 5.0 allow marking registers as arguments to a function, such that each call to the function will mark the line setting that register with the parameter name and/or type?
Is there some way to have the analyzer treat a 'call' as if the function called was actually in place of the call? Several functions that were probably used only in a single compilation unit end up using the stack frame of the one or two functions that call them, and that messed up analysis such that I have to figure out all the offsets myself, which is quite tedious.
How well does it's stack analysis work? Several times in IDA freeware, the program apparently misses a push or pop and throws off the use of arguments in a function so that every single one is called incorrectly. This could perhaps be caused by it's signatures having the wrong calling convention, but it happens quite rarely so it seems more likely to simply be a bug of some sort.
How well does it recognize basic structures such as 'switch' statements? In OllyDbg, most are recognized in the project I'm currently working on and it helps tremendously, but IDA Freeware doesn't seem to recognize any at all.
Are there any plugins that attempt to detect where a function is inlined and somehow mark that as an xref to the function itself? If not, how difficult would it be to make something like that? Inline functions give me a headache since I have to go comment each instance after figuring out the non-inlined version and it can take quite a while.
Another thing that bothers me is the IDA website - it has some oddities, such as the menu along the bottom not being updated to match the top menu (the bottom one takes you to and outdated news page, for example). Does such negligence reflect on a larger issue, or is it just that a bunch of programmers are trying to make a website?
Any other comments or suggestions would be greatly appreciated