While debugging 27mb binary;
- Open strings menu.
- CTRL + F
- Type something
- Ida freezes
Totally painful experience.
Hi @bukowa,
We understand the frustration, but it’s difficult to offer accurate suggestions without more context.
Could you please provide further details, and ideally, share the binary with us through our official support channel?
Several factors could affect the performance, like:
- structure of the binary,
- OS,
- number of libraries loaded,
- whether you’re attaching to a process or starting one
We’ll try to provide you with some tips once we have more information!
Hey, I don’t think it matters, IDA should never freeze the main thread when searching.
It would be helpful to allow us to attempt to reproduce…
I found a 27mb binary to debug, opened the strings menu, hit Ctrl + F and typed something and my instance of IDA didn’t freeze… the closer we can get to being able to reproduce your environment and unique configuration the more likely we are to get to the root of what should be happening.
Sorry I can’t share the binary, but if that helps its 32bit, windows10 - it has ton of libraries loaded. 1GB of memory used.
CheatEngine doesn’t freeze the main thread when searching
You say “searching” but the term can mean different things. Could you tell us the exact actions in IDA’s UI you’re using? some screenshots or a short screencast could go a long way.
Open strings menu ctr + f and search.
Thank you. By “strings menu”, do you mean the Strings subiew (Shift-F12), or something else? If yes, was the string list already built before you started the debugging, or you first opened it during debugging? I would once again request the exact actions (with menu items etc.) or some screenshots/videos so we know exactly what you were doing to try reproducing the issue.
also have some few seconds freezes when set type of any functions by press Y in decompliler
Can you tell me how should I open it to not encounter any freezes?
Could you please reply to my previous questions?
If main thread is freezing there’s something wrong.
Open strings menu (subview) open it after you start debbuging.
-
CTRL + F
-
Type something
-
Ida freezes
If you first open the strings window only after you start debugging, IDA has to scan the whole address space, including the newly loaded modules, stack, and heap memory. How many strings in the list do you get?
I think there’s misunderstanding, if IDA freezes it means the implementation of string searching is bad. It should never freeze or stop the main thread, it should never interfer with my work.
to fix the issue we first need to reproduce it. So far we were not successful.
Here is AI generated script that took me 5 seconds.
Open python.exe in IDA - change process options - as argument put filename of this script.
Start process open strings menu.
Here is another one, https://gist.githubusercontent.com/bukowa/a640c2deab0fab4496f3c4f52c69761c/raw/4d6b9c5c02e5f88f6a64fb260a01772c9c33c0dd/run2.py
P.S When you click cancel here you have to restart IDA otherwise it won’t populate strings again.
If You right click anywhere in strings window there’s Rebuild... button which will create/update all the strings in database.
It seems like You’re not that familiar with the tool.
Yea I am not familiar - I am new - probably why I have so many questions and issues.
Rebuild… button - great that it works but it’s another bad implementation that is totally not explicit.
I am not informed in any way of buttons like that. Seems like IDA just throws more buttons for every problem.
The trouble is finding them in the UI;
IDA GUI is very non-intuitive when it comes to basic stuff. Like naming convetions for example;
View → Open SubViews
Debugger → Quick Debug Windows
The same for searching stuff. In some windows like psedocode ctrl + f doesn’t work at all.
How to undo? I just opened another issue about this.
Same issue when IDA just keeps opening more and more pseudocode views when debugging, which is like magic behavior and totally not standard way to open a lot of windows when something happens. I bet theres a button to change that in the settings but ohh well.
Imagine if each subview could have it’s own menu instead of the main menu being “the menu” for them all.
I do agree with You on the pseudocode windows, I also find myself with 10+ of them and have to reload layout to get rid of them fast but how does rest of it make sense ? This software was first released in 1996 (at least that’s what Google says) and You’re saying You don’t like how core functionality works. It’s not some small tweak that can be changed in minor update, You just don’t like the whole workspace. I agree that IDA is not really beginner friendly but that’s just a price for all the features it has. Every time I try to use something from other companies there’s always something lacking (for now at least). I’ve spent few good years with it already and trust me it’s way faster than other more “user friendly” tools.
Why not read manual or some documentation if You don’t know how something works ? It’s a tool for reverse engineering and You can’t seem to bring Yourself to “reverse engineer” how undo works.