To best utilize this plug-in the user needs to understand its
features and capabilities. When a user runs the plug-in they will
be prompted with a window that is shown in Figure 3 . Each
of the options shown in Figure 3 are described
Loop detection plug-in options
- Graph Loop
This feature will visualize the loops, marking the entry of a loop
with green border, the exit of a loop with a red border and a loop
node with a yellow border.
- Highlight Function Calls
This option allows the user to highlight the background of any
function call made within the loop. The highlighting is done within
- Output Stack Information
This is a feature that is only enabled with the graph
loop option. When this option is enabled the graph will contain
information about the stack of the function including the variables
name, whether or not it is an argument, and the size of the
variable. This option is a great feature for static auditing.
- Highlight Code
This option is very similar to Highlight Function except instead of
just highlighting function calls within loops it will highlight all
the code that is executed within the loops. This makes it easier to
read the loops in IDA View
- Verbose Output
This feature allows the user to see how the program is working and
will give more information about what the plug-in is doing.
- Auto Commenting
This option adds comments to loops nodes, such as where
the loop begins, where it exits, and other useful information so that
the user doesn't have to continually look at the graph.
- All Loops Highlighting of Functions
This feature will find every loop within the IDA
database. It will then highlight any call to any function within a
loop. The highlighting is done within the IDA View making navigation
of code easier.
- All Loops Highlighting of Code
This option will find every loop within the database. It will then
highlight all segments of code involved in a loop. The highlighting
of code will allow for easier navigation of code within the IDA
- Natural Loops
This detection feature allows the user to only see natural loops. It
may not pick up all loops but is an educational implementation of
the previously discussed algorithm.
- Recursive Function Calls
This detection option will allow the user to see where recursive
function calls are located.