Igor’s Tip of the Week #150: Extract function

Malware Analysis
1

When you open a decompilable file in IDA, you get this somewhat mysterious item in the Help menu:

And if you invoke it, it shows an even more mysterious dialog:

So, what is it and when it is useful?

Originally this feature was added to the decompiler to make decompiler bug reporting easier: oftentimes. a decompiler issue cannot really be reproduced or debugged without having the original database. However, in some cases sharing the whole database is impractical or impossible:

  • Whole database may be very large and difficult to share
  • parts of the database may contain private or confidential information
  • the rest of the database is not really relevant to the issue and only adds noise

This feature leaves just the current function plus maybe some potentially relevant information in the database. It can then be sent to support for investigation and fixing, either by email or directly from IDA via Help > Report a bug or an issue…

 

See also:

Igor’s tip of the week #39: Export Data

Igor’s Tip of the Week #135: Exporting disassembly from IDA

Decompiler Manual: Failures and troubleshooting

Article Link: Igor’s Tip of the Week #150: Extract function – Hex Rays