IDA - Create Process Flow Map Between 2 Sub-Routines

Question

Using IDA, can I specify 2 Sub-Routines (really, it's 2 WINAPI calls) and have IDA create a "map" between the 2 points? I want to know all the possible branches the EIP can take from one instruction to another instruction.

I am using IDA-Pro 6.0 (or 6.1).

Thank you.

Edit - I can only use static analysis tools for this.

Thank you for such a fast reply. I will look at this. I edited my question just now to include a detail about require a static analysis solution. — Lokked, Nov 15 '17 at 19:03
The solution in the post I linked to does not rely on dynamic analysis BTW. — Igor Skochinsky, Nov 16 '17 at 13:47
Thank you, Igor. I wanted to make the question more specific to avoid answers involving Traces. Is your solution viable with the specified version of IDA, perhaps as a plugin? I see that feature is packaged with 6.2+ versions. — Lokked, Nov 16 '17 at 20:04

score 2 · Accepted Answer · answered Nov 16 '17 at 08:06

You can use the alleycat plugin to find the path between two functions/basic blocks etc.

Example

Finding the path between two functions http_init_main and http_parser_set_challenge in a mipsel elf.

Go to View -> Find paths from current function to...
Select the target function.
Alleycat would display the path to reach the selected function from initial function. Additionally, the corresponding basic blocks would be highlighted in the graph view.

IDA - Create Process Flow Map Between 2 Sub-Routines

1 Answers1

Example

Linked