Kernel analysis options 1
Trace execution flow
This option allows IDA to trace execution flow and convert all
references bytes to instructions.
Mark typical code sequences as code
IDA knows some typical code sequences for each processor.
For example, it knows about typical sequence
mov bp, sp
If this option is enabled, IDA will search for all typical sequences
and convert them to instructions even if there are no references
to them. The search is performed at the loading time.
Locate and create jump tables
This option allows IDA to try to guess the address and size of jump
tables. Please note that disabling this option will not disable
the recognition of C-style typical switch constructs.
Control flow to data segment is ignored
If set, IDA will not analyze code reference targets in
pure data segments. Usually pure data segments have some
instructions (e.g. thunk functions), that's why this option
is set off by default. For Mach-O files, it is set on
because pure data segment do not contain instructions in them.
Analyze and create all xrefs
If this option is disabled, IDA will not thoroughly analyze the program: it
will simply trace execution flow, nothing more (no xrefs, no additional
Delete instructions with no xrefs
This option allows IDA to undefine instructions without any xrefs to them.
For example, if you undefine an instruction at the start of a
function, IDA will trace execution flow and delete all instructions
that lose references to them.
Create function if data xref data->code32 exists
If IDA encounters a data reference from DATA segment to 32bit
CODE segment, it will check for the presence of meaningful
(disassemblable) instruction at the target. If there is an
instruction, it will mark it as an instruction and will create
a function there.
Create functions if call is present
This option allows IDA to create function (proc) if a call
instruction is present. For example, the presence of:
leads to creation of a function at label loc_1234
Create function tails
This option allows IDA to find and append separately located
function tails to function definitions.
Create stack variables
This option allows IDA to automatically create stack variables and
Propagate stack argument information
This option propagates the stack argument information
(the type and the name) to the caller's stack. If the caller is
called, then the information will be propagated further through
the whole program. Currently, the type propagation is really
simple and non-intelligent: the first encountered type for
a stack variable will be used.
Propagate register argument information
This option propagates the register argument information
(the type and the name) to the caller. If the caller is
also called, then the information will be propagated further through
the whole program.
Trace stack pointer
This option allows IDA to trace the value of the SP register.
Perform full stack pointer analysis
This option allows IDA to perform the stack pointer
analysis using the simplex method. This option is valid
only for the IBM PC processor.
Perform 'no-return' analysis
This option allows IDA to perform the control flow
analysis and determine functions which do not return to
their callers. The 'exit()' function, for example, does not
return to its caller.
Try to guess member function types
If set, IDA will guess member function types using the demangled
names. Please note that this rule may occasionally produce wrong
results, for example, for static member functions. IDA has no
means of distinguishing them from non-static member functions.
If clear, IDA will guess only types of non-member functions.
See also analysis options 2
| Previous topic
| Next topic