3 ms·

Would you mind describing some of the cfg recovery problems IDA can solve that open source tools can’t? This sounds quite interesting.

• goldenkey 8y ago
  IDA has a ton of hacks in it that arent exactly common or public knowledge. There are hundreds of anti-debugger/dissasembler instruction sequences that will crash or stall or corrupt analysis tools. To even identify all the instructions which can be used for control flow, which alter which flags and how, for multiple architectures, is a royal man hour grunt work marathon. And as we see with the latest round of speculative load exploits, a lot of branches cannot even be predicted appropriately because they could be using exploits relying on undefined behavior..side channels. So the whole issue of perfect control flow analysis is a more mechanical one than a pure abstraction based one. When OllyDbg was first built it was the same way. Oleg put thousands od hours into whack a moling every issue. Most people like elegant endeavors based on some core principles. In static analysis of complex ISAs, the core principle is documenting 10000 species of moths, not finding that they all have wings..