Kernel analysis options 2

Truncate functions upon code deletion
  Truncate functions when the code at the function end gets deleted.
  If this option is turned off, IDA does not modify function
  definitions when code is deleted.
Create string literals if data xref exists
  If IDA encounters a data reference to an undefined item, it checks for the
  presence of the string literal at the target. If the length of the candidate
  string literal is big enough (more than 4 chars in 16bit or data
  segments; more than 16 chars otherwise), IDA will automatically create
  a string literal.
Check for unicode strings
  This option allows IDA to check for the presence of the unicode
  strings in the program and creates them if necessary.
  IDA will check for the unicode strings only if the string style
  is set to "C-style (0 terminated)" or "Unicode".
Create offsets and segments using fixup info
  IDA will use relocation information to make the disassembly
  nicer. More precisely, it will convert all data items with
  relocation information to words or dwords like this:
          dd offset label
          dw seg seg000
  If an instruction has a relocation information attached to it,
  IDA will convert its immediate operand to an offset or segment:
          mov     eax, offset label
  You can display the relocation information attached to the current
  item by using show internal flags command.
Create offset if data xref to seg32 exists
  If IDA encounters a data reference to 32bit segment and the target
  contains 32bit value which can be represented as an offset expression,
  IDA will convert it to an offset.
Convert 32bit instruction operand to offset
  This option works only in 32bit and 64bit segments.
  If an instruction has an immediate operand and the operand
  can be represented as a meaningful offset expression, IDA will
  convert it to an offset. However, the value of immediate operand
  must be higher than 0x10000.
Automatically convert data to offsets
  This option allows IDA to convert all newly created data items
  to offsets if the following conditions are satisfied:
    - the offset target is a valid address in the program
    - the target address is higher than 0x20
    - the target does not point into the middle of an item
    - if the target is code, the execution does not flow to it
      from the previous instruction
    - the data is dword (4 bytes) in a 32-bit segment
      or qword(8 bytes) in a 64-bit segment
    - the segment type is not special (extern, communal, abs...)
Use flirt signatures
  Allows usage of FLIRT technology
Comment anonymous library functions
  This option appends a comment to anonymous library functions.
  The comment consists of the description of the FLIRT signature
  which has recognized the function and marked it as coming
  from a library.
Multiple copy library function recognition
  This option allows FLIRT to recognize several copies of the same
  function in the program.
Automatically hide libary functions
  This option hides the functions recognized by FLIRT.
  It will have effect only from the time it is set.
Rename jump functions as j_...
  This option allows IDA to rename simple functions containing only
          jmp somewhere
  instruction to "j_somewhere".
Rename empty functions as nullsub_...
  This option allows IDA to rename empty functions containing only
  a "return" instruction as "nullsub_..."
  (... is replaced by a serial number: 0,1,2,3...)
Coagulate data at the final pass
  This option is meaningful only if "Make final analysis pass"
  is enabled. It allows IDA to convert unexplored bytes
  to data arrays in the non-code segments.
Coagulate code at the final pass
  This option is meaningful only if "Make final analysis pass"
  is enabled. It allows IDA to convert unexplored bytes
  to data arrays in the code segments.
Make final analysis pass
  This option allows IDA to coagulate all unexplored bytes
  by converting them to data or instructions.
See also analysis options 1
Index | Previous topic | Next topic