Retrospective Analysis is a plugin compatible with IDA Pro that enhances the reverse engineering process. It performs backward analysis of function calls using a layered system, predicts and modifies function types, and removes unused parameters after these modifications. This process aims to accelerate and simplify the analysis workflow for reverse engineers.
The analysis integrates seamlessly into your workflow, starting directly from the context menu of the decompiled view.
The analysis begins from the selected function and iteratively scans the call hierarchy up to a user-defined depth (1-10 layers). Each layer represents a group of function calls, enabling a detailed examination of call relationships.
Analyzes function call types (e.g., __thiscall, __stdcall), modifies them, and removes unused parameters afterward.
Analyzes function call types, identifies inconsistencies or common patterns, and improves the function signature.
This feature identifies and analyzes unused parameters within call references. It ensures cleaner and more optimized function signatures by removing redundant parameters detected in the call hierarchy.
Start the analysis directly from the context menu in the decompiled view (as shown in the image).
Automatically refreshes the decompiled view after making changes.
-
Select a Function
Open the decompiled view in IDA Pro and right-click the function you want to analyze. -
Start the Analysis
Select Retrospective Analysis from the context menu.
-
Optionally Configure Analysis Settings
Adjust the analysis depth (1-10 layers) and start the analysis.
-
Review the Results
The plugin modifies call types and cleans up unused parameters. Review these changes in the decompiled view.
-
Virtual Call Handling
Virtual calls must currently be adjusted manually.
-
Return Type Analysis
Planned for future releases. -
Accuracy
While the analysis achieves a high accuracy rate in identifying call types and unused parameters, incorrect results may still occur. Manual review is recommended.
- Download the latest release from GitHub Releases.
- Place the plugin file in the
pluginsdirectory of your IDA Pro installation. - Restart IDA Pro. The plugin will appear in the context menu of the decompiled view.
- Automating virtual call type corrections (For now, this must be done manually because I have yet to determine which library function to call to modify the types of these virtual calls).
- Adding return type analysis functionality.
We welcome your contributions! Fork the repository, submit a pull request, and help improve the plugin. Feedback and suggestions, especially for automating virtual call handling and return type analysis, are highly valued.