Analysing take long time

[gl4nce]

Is it normal, adding an IPA analyse time take over 24h? I've added an IPA yesterday and the analyzing process is still running. In the log I can see a lot of UPDATE queries and the sqlite database is increasing (atm 144MB).

[...]
Jan. 30, 2025 6:35:40 PM com.lauriewired.malimite.decompile.GhidraProject decompileMacho
INFORMATION: Storing decompilation for Global::FUN_10049b95c
Jan. 30, 2025 6:35:40 PM com.lauriewired.malimite.database.SQLiteDBHandler updateFunctionDecompilation
INFORMATION: Database update for FUN_10049b95c affected 1 rows
Jan. 30, 2025 6:35:40 PM com.lauriewired.malimite.decompile.GhidraProject decompileMacho
INFORMATION: Storing decompilation for Global::FUN_10049b960
Jan. 30, 2025 6:35:42 PM com.lauriewired.malimite.database.SQLiteDBHandler updateFunctionDecompilation
INFORMATION: Database update for FUN_10049b960 affected 1 rows
Jan. 30, 2025 6:35:42 PM com.lauriewired.malimite.decompile.GhidraProject decompileMacho
INFORMATION: Storing decompilation for Global::FUN_10049b9d4
Jan. 30, 2025 6:35:53 PM com.lauriewired.malimite.database.SQLiteDBHandler updateFunctionDecompilation
INFORMATION: Database update for FUN_10049b9d4 affected 1 rows
Jan. 30, 2025 6:35:53 PM com.lauriewired.malimite.decompile.GhidraProject decompileMacho
INFORMATION: Storing decompilation for Global::FUN_10049bbe0

[LaurieWired]

Wow! What's the size of the IPA / mach-o you're analyzing? Or if you can share the file, I can do some testing to see.

If the executable has a ton of libraries inside, that might take a really long time to decompile. To speed up and reduce analysis, you can also try excluding libraries by class name and they'll be ignored. File -> Configure Libraries, then you can add names or partial names of library classes you want to skip before you start analysis.

I may also start thinking of some optimizations for handling large files since IPAs can be pretty chunky.

[leonewton253]

Wow! What's the size of the IPA / mach-o you're analyzing? Or if you can share the file, I can do some testing to see.

If the executable has a ton of libraries inside, that might take a really long time to decompile. To speed up and reduce analysis, you can also try excluding libraries by class name and they'll be ignored. File -> Configure Libraries, then you can add names or partial names of library classes you want to skip before you start analysis.

I may also start thinking of some optimizations for handling large files since IPAs can be pretty chunky.

Im analyzing one thats 21 MB. I'll try and download the smallest one I can find and see how long it takes.

[kirand777]

The same is for me. I waited for 1-2 hours, analysis info shown a lot of errors and I decided force quit it. The app idea is good, but functionality is still very raw.

[sleeyax]

I'm also experiencing an extremely long analysis time.

After investigating I noticed that this function is taking ~20s / operation on average to complete:

Malimite/src/main/java/com/lauriewired/malimite/decompile/GhidraProject.java

Line 228 in 93439e2

dbHandler.updateFunctionDecompilation(functionName, className, decompiledCode, targetMacho.getMachoExecutableName());

(or see for yourself how long the Storing decompilation for ... part takes in your output log)

I have over 5000 functions to analyse in a relatively big 85MB+ IPA, so at this speed that part alone would take about 27+ hours to complete!

Debugging this further, it seems like the database is the actual bottleneck here. I spent some time refactoring the database handler to use a shared connection and SQL transactions and managed to bring it down to ~5 operations / s. That's a 100x improvement in speed! I'll create a PR soon.

I should add that I store my data on an average quality HDD. Perhaps this issue isn't as noticable to people on fast Apple hardware with SSD?