static enable_proc_options(proc) /* enable a processor options wizard page */ { PushXML("ancestor::wizard[1]"); /* work at the parent wizard level */ SetXML("page[starts-with(@X, 'processor_')]/@visible", "", "false"); /* disable all others processor options pages */ SetXML("page[@X='processor_" + proc + "_p']/@visible", "", "true"); /* enable the requested processor options page */ PopXML(); } static onClick_analysis_c(void) { auto checked, proc; checked = GetXML("@checked"); /* show/hide the main kernel options page */ SetXML("../../page[@X='kernel_p']/@visible", "", checked); /* if a unique processor was specified by the template, show/hide its options page */ if (GetXML("count(/ida/loading/processor)") == 1) { proc = checked == "true" ? GetXML("/ida/loading/processor/@name") : ""; enable_proc_options(proc); } } static onClick_processors_p(void) { /* a processor was selected, enable the Next button */ SetXML("../@next", "", "true"); } Analysis This option allows IDA to trace execution flow and convert all references bytes to instructions. Without this option IDA will not thoroughly analyze the program. If this option is disabled, IDA will simply trace execution flow, nothing more (no xrefs, no additional checks, etc). Functions This option allows IDA to create a function (proc) if a call instruction is present. For example, the presence of: call loc_1234 leads to creation of a function at label loc_1234. This option allows IDA to find and append separately located function tails to function definitions. If IDA encounters a data reference from DATA segment to 32bit CODE segment, it will check for the presence of meaningful (disassemblable) instruction at the target. If there is an instruction, it will mark it as an instruction and will create a function there. This option allows IDA to rename simple functions containing only jmp somewhere instruction to "j_somewhere". This option allows IDA to rename empty functions containing only a "return" instruction as "nullsub_..." (... is replaced by a serial number: 0,1,2,3...). Library functions Allows usage of FLIRT technology. This option hides the functions recognized by FLIRT. It will have effect only from the time it is set. This option appends a comment to anonymous library functions. The comment consists of the description of the FLIRT signature which has recognized the function and marked it as coming from a library. This option allows FLIRT to recognize several copies of the same function in the program. Stack This option allows IDA to automatically create stack variables and function parameters. This option allows IDA to trace the value of SP register. Argument information propagation This option propagates the stack argument information (the type and the name) to the caller's stack. If the caller is called then the information will be propagated further through the whole program. Currently the type propagation is really simple and non-intelligent: the first encountered type for a stack variable will be used. This option propagates the register argument information (the type and the name) to the caller. If the caller is also called then the information will be propagated further through the whole program. Strings This option allows IDA to check for the presence of the unicode strings in the program and creates them if necessary. IDA will check for the unicode strings only if the string style is set to "C-style (0 terminated)" or "Unicode". If IDA encounters a data reference to an undefined item, it checks for the presence of the ASCII string at the target. If the length of the ASCII string is big enough (more than 4 chars in 16bit or data segments; more than 16 chars otherwise), IDA will automatically create an ASCII string. Heuristic - Final analysis This option allows IDA to coagulate all unexplored bytes by converting them to data or instructions. IDA knows some typical code sequences for each processor. For example, it knows about typical sequence push bp mov bp, sp If this option is enabled, IDA will search for all typical sequences and convert them to instructions even if there are no references to them. The search is performed at the loading time. This option allows IDA to undefine instructions without any references to them. For example, if you undefine an instruction at the start of a function, IDA will trace execution flow and delete all instructions that lose references to them. This option works only in 32bit segments. If an instruction has an immediate operand and the operand can be represented as a meaningful offset expression, IDA will convert it to an offset. However, the value of immediate operand must be higher than 0x10000. If IDA encounters a data reference to 32bit segment and the target contains 32bit value which can be represented as an offset expression, IDA will convert it to an offset. This option is meaningful only if "Make final analysis pass" is enabled. It allows IDA to convert unexplored bytes to data arrays in the data segments. If this option is disabled, IDA will coagulate only code segments. IDA will use relocation information to make the disassembly nicer. In particular, it will convert all data items with relocation information to words or dwords like this: dd offset label dw seg seg000 If an instruction has a relocation information attached to it, IDA will convert its immediate operand to an offset or segment: mov eax, offset label You can display the relocation information attached to the current item by using show internal flags command. This option allows IDA to convert all newly created data items to offsets if the following conditions are satisfied: - the offset target is a valid address in the program - the target does not point into the middle of an item - if the target is code, the execution does not flow to it from the previous instruction - the data is dword (4 bytes) in a 32-bit segment or qword(8 bytes) in a 64-bit segment - the segment type is not special (extern, communal, abs...) Misc This option allows IDA to try to guess the address and size of jump tables. Please note that disabling this option will not disable the recognition of C-style typical switch constructs. The input file will now be loaded in IDA. Click Finish to start loading the input file in IDA.