6

Using IDA 6.2 (and also with IDA 6.4), I'm trying out the Proximity viewer to find the path between 2 functions as described at the hexblog post here.

Using the Xrefs From/To (old option) it shows the clear path: AllocateVolume -> VolumeSortCmp -> CompareVolumeComponents as shown in the screenshot below

Apart from the add name and hide childs options not existing in the context menu (as described in the blog) of the proximity browser as seen in the screenshot below the find path menu does list CompareVolumeComponents in the dialog that opens (so it has some knowledge of what is reachable).

However when I press search I expected a nice clean graph (as again shown in the blog and added as reference below) showing only the the 3 relevant nodes, but instead nothing seems to change to the proximity browser layout as I still see 30 something nodes.

Hexblog condensed Find path example result hexblog condensed example result

My result enter image description here

Is the proximity viewer malfunctioning or are my expectations off? Or am i doing something wrong here?

ixje
  • 1,733
  • 14
  • 25

2 Answers2

5

I think that the problem is a misunderstanding of how the Proximity Viewer works. It will not clear out all the other nodes in the graph when finding a path: it simply finds a path and adds the required nodes to the graph. If you want to view only the nodes between AllocateVolume and CompareVolumeComponents, do the following:

  1. Navigate to AllocateVolume and press '-'.
  2. Right click on the center node AllocateVolume and select "Collapse children", then, "Collapse parents" as well.
  3. Then, right click outside this node in the proximity view and select "Add name".
  4. Find "CompareVolumeComponents" and add it.
  5. After this step, right click on the AllocateVolume node, select "Find Path" and select the only other available node.

If everything goes OK, you will have a graph with only the functions required to display a path from AllocateVolume to CompareVolumeComponents. If it does not, there may be some problem with the current code of the Proximity Viewer (in that case, please contact support at Hex-Rays for a fix). Also, you may want to take a look to the "callgraph" plugin in the SDK: the algorithm to find paths is pretty much the same and you may get an idea about why it isn't working.

As a side note, a little explanation of how the PV works: The algorithm does not consider a path only calls/jmps as (Q)WinGraph32 does (IIRC) but also consider a path when there are data references. If a function A references, in any way, function B, then the proximity viewer will show that reference (with a gray edge instead of a blue edge). BTW, I'm the guy who wrote it.

joxeankoret
  • 4,488
  • 2
  • 21
  • 35
  • 1
    thanks that explanation did the trick (like f.e. clicking outside the node for add name). I guess I need to experiment a bit more because I honestly thought I tried all the hiding options without success. On a side node are you aware of any options dialog such that we can configure to find n-paths or all paths? As right now it finds just 1, not all. See single path & With manual help all paths Otherwise I'll try hex-rays support. – ixje Apr 05 '13 at 09:14
  • @justsome Not yet. This is something that was discussed in Hex-Rays but, at least in the current public versions, is not implemented. – joxeankoret Apr 05 '13 at 11:16
  • Can't find "Add name" in IDA 6.8, tried clicking on the node, next to the node, on the icons, on the text. When is this suppose to show up? – Flip May 29 '17 at 15:51
3

What your screenshot shows is not the proximity browser. It's the old Wingraph32 stuff that came already with the 5.x versions of IDA. See the attached picture for how the real thing looks:

Proximity browser (direct link to full size image)

You can find it under View -> Open subviews -> Proximity browser

Keep in mind that if you still use 6.2, there'll likely be a Qt version (idaq.exe) and the old Windows GUI version (idag.exe). You'll want the former for the proximity browser to work.

0xC0000022L
  • 10,908
  • 9
  • 41
  • 79
  • I know this is the Wingraph32, the title of the window in the screenshot also says so. That screenshot was also referring to the text above the screenshot ("Xref to/from"). I was trying to point out that the old Wingraph32 has a "clear path" while the new proximity browser (of which I did not add a screenshot) has a worse and more cluttered path. – ixje Apr 04 '13 at 21:40
  • @justsome: okay, this wasn't all too obvious from your question. Maybe you could add a screenshot and point out the parts that appear "cluttered" to you. The thing is that you can expand and nodes, zoom in and out around nodes. In this case please clarify your question and I'll try to answer it better. – 0xC0000022L Apr 04 '13 at 23:35
  • I've added all the pictures and rephrased some text to hopefully finally make my question unambiguous :-) I've also now tried it with IDA 6.4 to rule out the cause being an old version. – ixje Apr 05 '13 at 06:56
  • @justsome: I see one of the former Hex-Rays employees has answered your question better already. With the screenshots it was more obvious what you wanted. – 0xC0000022L Apr 05 '13 at 13:11
  • I intended to put screenshots like this in but time pressure forced me to only add one. Still thanks for the effort! -edit- for some reason I can't seem to start my comment with @0xC0000022L, it gets removed automatically.. – ixje Apr 05 '13 at 15:40