Auto analysis
Auto analysis reacts to changes in a program and schedules analyzers that can add functions, references, data, and other information. Those additions can trigger more analysis. An imported program has not necessarily had its initial analysis run.
Run and inspect
Section titled “Run and inspect”- Open the program in CodeBrowser.
- Choose Analysis → Auto Analysis in the upstream baseline.
- Inspect the enabled analyzers and options, then start the run.
- Let background tasks finish and inspect warnings or analysis bookmarks.
- Save the program and record settings that differ from the defaults.
With no Listing selection, analysis covers the program’s memory. A selection restricts its starting scope, but consequences such as reference discovery can affect addresses outside the selection. VERIFY Opcodex menu names and analyzer availability for your processor.
Diagnose weak results
Section titled “Diagnose weak results”Check the loader, language, memory map, entry points, and code/data boundaries before running more analyzers. A wrong initial assumption can produce a large amount of misleading output.
Use a small known function as a sanity check. Compare calls and branches in the Listing with the Decompiler. Treat inferred names and types as hypotheses until you find supporting evidence. Analysis completion means the requested tasks finished; it is not a correctness certificate.
For a repeatable run, record the sample hash, application version, import settings, and enabled analyzers. Use headless mode for batch workflows.
Source: Auto Analysis help.
Adapted from the Ghidra documentation (Apache 2.0).