---------------------------------------------------------------------------
Runtime-evaluated addressing resolver plugin for Ida Pro by servil
version 0.978 beta 10/2008
supported Ida versions: 4.90 and above till SDK API change
---------------------------------------------------------------------------

Flowinsp reveals run-time evaluated call/jump targets
(eg. call dword ptr [ecx+1ch], jmp eax, etc), especially suitable for binaries
written in high-level language using OOP. Resolving is done in application
tracing mode (thus the debuggee is fully run during plugin activity).
Flowinsp only runs for Win32-PE targets (due to tracing layer API).
It is optional how the caller -> callee pairs are described in idabase (as
comments, x-refs, or by renaming o_mem address).
Warning: host application may run _very_ slow if too much calls executed and
host can even crash if pure data is disassembled by Ida in fallacy. To reduce
this kind of collisions, basic filtering is available in start-up dialog.
Both, programs and dlls are supported: for dlls, select a proper loader when
asked and wait till the library is loaded and some code executed (loader must
be a directly executable by CreateProcess API (ie. the main program), loader
once chosen is saved to idabase for all future runs).
Notice: plugin fully executes code in host application. be warned of resolving
modules possibly containing malicious code (ie. viruses, trojans, spyware etc.)

to install simply copy .plw to <ida>\plugs dir and restart ida.

known bugs and limitations:
shure ;)

servil
