IDA Help: Kernel analysis options 1

Trace execution flow

  This option allows IDA to trace execution flow and convert all
  references bytes to instructions.

Mark typical code sequences as code

  IDA knows some typical code sequences for each processor.
  For example, it knows about typical sequence

          push    bp
          mov     bp, sp

  If this option is enabled, IDA will search for all typical sequences
  and convert them to instructions even if there are no references
  to them. The search is performed at the loading time.

Locate and create jump tables

  This option allows IDA to try to guess the address and size of jump
  tables. Please note that disabling this option will not disable
  the recognition of C-style typical switch constructs.

Control flow to data segment is ignored

  If set, IDA will not analyze code reference targets in
  pure data segments. Usually pure data segments have some
  instructions (e.g. thunk functions), that's why this option
  is set off by default. For Mach-O files, it is set on
  because pure data segment do not contain instructions in them.

Analyze and create all xrefs

  If this option is disabled, IDA will not thoroughly analyze the program: it
  will simply trace execution flow, nothing more (no xrefs, no additional
  checks, etc)

Delete instructions with no xrefs

  This option allows IDA to undefine instructions without any xrefs to them.
  For example, if you undefine an instruction at the start of a
  function, IDA will trace execution flow and delete all instructions
  that lose references to them.

Create function if data xref data->code32 exists

  If IDA encounters a data reference from DATA segment to 32bit
  CODE segment, it will check for the presence of meaningful
  (disassemblable) instruction at the target. If there is an
  instruction, it will mark it as an instruction and will create
  a function there.

Create functions if call is present

  This option allows IDA to create function (proc) if a call
  instruction is present. For example, the presence of:

          call loc_1234

  leads to creation of a function at label loc_1234

Create function tails

  This option allows IDA to find and append separately located
  function tails to function definitions.

Create stack variables

  This option allows IDA to automatically create stack variables and
  function parameters.

Propagate stack argument information

  This option propagates the stack argument information
  (the type and the name) to the caller's stack. If the caller is
  called, then the information will be propagated further through
  the whole program. Currently, the type propagation is really
  simple and non-intelligent: the first encountered type for
  a stack variable will be used.

Propagate register argument information

  This option propagates the register argument information
  (the type and the name) to the caller. If the caller is
  also called, then the information will be propagated further through
  the whole program.

Trace stack pointer

  This option allows IDA to trace the value of the SP register.

Perform full stack pointer analysis

  This option allows IDA to perform the stack pointer
  analysis using the simplex method. This option is valid
  only for the IBM PC processor.

Perform 'no-return' analysis

  This option allows IDA to perform the control flow
  analysis and determine functions which do not return to
  their callers. The 'exit()' function, for example, does not
  return to its caller.

Try to guess member function types

  If set, IDA will guess member function types using the demangled
  names. Please note that this rule may occasionally produce wrong
  results, for example, for static member functions. IDA has no
  means of distinguishing them from non-static member functions.
  If clear, IDA will guess only types of non-member functions.

See also analysis options 2 analysis options 3 Index | Previous topic | Next topic