Igor’s tip of the week #98: Analysis options

The autoanalysis engine is the heart of IDA’s disassembly functionality. In most cases it “just works” but in rare situations tweaking it may be necessary.

Analysis options

The generic analysis options are available in Options > General, Analysis tab, Kernel Options 1..3.

The same settings are also available at the initial load time.

You can even turn off the autoanalysis completely by unchecking the “Enabled” checkbox. This can be useful, for example, if you have some custom analysis scripts or plugins specific to the target and want to run them before IDA’s own analysis. After running the scripts, analysis can be re-enabled to handle the remaining parts of the binary.

Processor-specific options

Some processor modules have additional options which are accessible via the “Processor options” button.

Toggling autoanalysis

In some situations where IDA does not behave correctly or even getting in your way, instead of looking for a specific setting to disable, it may suffice to quickly disable autoanalysis, perform some action, then enable it again for default behavior. For example, if you try to use the technique described in the tip #87 without deleting the function first, you may find yourself fighting the autoanalysis:

try to truncate the function at the start of the shared tail using “Set Function End” (shortcut E);
IDA truncates the main function and creates a separate tail chunk;
because the function (head chunk) and the tail are adjacent, the autoanalysis immediately merges them back into one big function.

To prevent the undesired merging, you can disable autoanalysis, perform the necessary manipulations, then re-enable it. This can be done by unchecking the “Enabled” checkbox in the Options dialog but there is a faster way: autoanalysis indicator button on the toolbar.

It is usually either a yellow circle with hourglass (autoanalysis in progress) or green circle (autoanalysis idle, waiting for user action). If you click the button, it will turn into a crossed red circle to indicate that autoanalysis has been disabled.

Click on the crossed circle again to re-enable autoanalysis.