8

I made IDA load an ~70MB executable, and it's been analyzing it for about 16 hours now (still not finished, although it's over half done). While there is progress, the progress is very, very slow. On the other hand, a 5MB file is analyzed within about 5 minutes. I remember a 40MB executable taking about 30-40 minutes to analyze, but this is nothing compared to >16 hours.

Hopper took about 2 hours (and used 6GB of RAM!) to analyze the same file, but it managed to complete it. After looking at the disassembly, it seems that the executable in question tends to use many function pointers (over directly invoking functions)

Is this normal? Is there anything I can do to speed up the process?

MiJyn
  • 181
  • 1
  • 1
  • 4
  • 1
    This sounds to me like IDA needs more than the available RAM, and the OS starts paging parts of your process in and out, which generally delays things tremendously. Check your appropriate system tools (resmon/task manager in windows, top/vmstat in linux) for the amount of available/memory and disk activity. And ofc, make sure you're using the 64 bit version of IDA. – Guntram Blohm Apr 19 '16 at 22:16
  • 1
    It's using ~9% of my RAM, so, less than a GB :) I actually had both Hopper and IDA running at the same time, and Hopper was the huge RAM hog (it's not running now though)! It's running on one core, and very few other processes are taking up extra CPU, so I don't think it's a resources issue :) And yes, I'm using the 64-bit version of IDA (the executable in question is 64-bit as well) – MiJyn Apr 20 '16 at 01:14
  • I encountered such a problems when my idb was stored on a network disk. Hope that it's not your case. – w s Apr 20 '16 at 06:58
  • @ws Oh yes, that would probably be a pretty big issue, because it seems like as if it loads the idb dynamically (and doesn't just store the entire file in RAM). But no, this is all on my local HDD :) – MiJyn Apr 20 '16 at 07:00
  • since its 64-bit file (I its assume PE32+) try ArkDasm disassembler it has small memory footprint and the same shortcuts as IDA - www.arkdasm.com – MaxQ Apr 22 '16 at 21:46

1 Answers1

14

There are some tricks you can use to speed up the process.

IDA's Functions window, as well as some other windows, presents sorted data. This means that for every function added, it sorts the entire view. When operating on >100k functions, this can take a considerable (>1sec) amount of time. So if you have ~200K functions, the analysis will take forever, more or less.

I highly recommend closing (hiding is not enough) all views except the Output window. This should speed things up quite a bit.

Regarding the RAM, being a 32bit application, IDA can only take up up to about 3GB of memory. From my experience, it handles 100MB binaries well.

tmr232
  • 1,577
  • 8
  • 19
  • I think it did help the speed slightly, thank you! Each refresh in the status window is maybe half? a second, maybe a third, but it seems to be less than 16 bytes. Then again, I recall there being many, many small functions, about 5 instructions long, or less (in fact, the pictogram on IDA is entirely blue! minus the beige data, and the grey/black, of course) – MiJyn Apr 20 '16 at 06:26
  • Just to clarify though, this doesn't answer the question, because although I think it did make a bit of a difference, it's still very slow. I believe that the status window at the bottom is refreshing much faster now, sometimes even goes to ~30-50 bytes, but this is still too slow haha – MiJyn Apr 20 '16 at 06:58
  • Got a speedup of ~5x. Thank you!!!! – toster-cx Mar 16 '17 at 00:05
  • You're a live saver!! I can't believe IDA doesn't fix this... – Akababa Jul 12 '19 at 22:06