IDA Help: Kernel analysis options 2

Truncate functions upon code deletion

  Truncate functions when the code at the function end gets deleted.
  If this option is turned off, IDA does not modify function
  definitions when code is deleted.

Create string literals if data xref exists

  If IDA encounters a data reference to an undefined item, it checks for the
  presence of the string literal at the target. If the length of the candidate
  string literal is big enough (more than 4 chars in 16bit or data
  segments; more than 16 chars otherwise), IDA will automatically create
  a string literal.

Check for unicode strings

  This option allows IDA to check for the presence of the unicode
  strings in the program and creates them if necessary.
  IDA will check for the unicode strings only if the string style
  is set to "C-style (0 terminated)" or "Unicode".

Create offsets and segments using fixup info

  IDA will use relocation information to make the disassembly
  nicer. More precisely, it will convert all data items with
  relocation information to words or dwords like this:

          dd offset label
          dw seg seg000

  If an instruction has a relocation information attached to it,
  IDA will convert its immediate operand to an offset or segment:

          mov     eax, offset label

  You can display the relocation information attached to the current
  item by using show internal flags command.

Create offset if data xref to seg32 exists

  If IDA encounters a data reference to 32bit segment and the target
  contains 32bit value which can be represented as an offset expression,
  IDA will convert it to an offset.

Convert 32bit instruction operand to offset

  This option works only in 32bit and 64bit segments.
  If an instruction has an immediate operand and the operand
  can be represented as a meaningful offset expression, IDA will
  convert it to an offset. However, the value of immediate operand
  must be higher than 0x10000.

Automatically convert data to offsets

  This option allows IDA to convert all newly created data items
  to offsets if the following conditions are satisfied:
    - the offset target is a valid address in the program
    - the target address is higher than 0x20
    - the target does not point into the middle of an item
    - if the target is code, the execution does not flow to it
      from the previous instruction
    - the data is dword (4 bytes) in a 32-bit segment
      or qword(8 bytes) in a 64-bit segment
    - the segment type is not special (extern, communal, abs...)

Use flirt signatures

  Allows usage of FLIRT technology

Comment anonymous library functions

  This option appends a comment to anonymous library functions.
  The comment consists of the description of the FLIRT signature
  which has recognized the function and marked it as coming
  from a library.

Multiple copy library function recognition

  This option allows FLIRT to recognize several copies of the same
  function in the program.

Automatically hide libary functions

  This option hides the functions recognized by FLIRT.
  It will have effect only from the time it is set.

Rename jump functions as j_...

  This option allows IDA to rename simple functions containing only

          jmp somewhere

  instruction to "j_somewhere".

Rename empty functions as nullsub_...

  This option allows IDA to rename empty functions containing only
  a "return" instruction as "nullsub_..."
  (... is replaced by a serial number: 0,1,2,3...)

Coagulate data at the final pass

  This option is meaningful only if "Make final analysis pass"
  is enabled. It allows IDA to convert unexplored bytes
  to data arrays in the non-code segments.

Coagulate code at the final pass

  This option is meaningful only if "Make final analysis pass"
  is enabled. It allows IDA to convert unexplored bytes
  to data arrays in the code segments.

Make final analysis pass

  This option allows IDA to coagulate all unexplored bytes
  by converting them to data or instructions.

See also analysis options 1 analysis options 3 Index | Previous topic | Next topic