My assumption is that it goes through the .text section (already knowing the ABI and expected calling convention) looking for any form of call opcode (call, bl, whatever) and then deduces that the call location is a function. From there, I think it must use whatever its collected in this pass to then work out that certain functions correlate to symbol table entries?I have ELF in mind when I'm trying to work out how IDA does it (or, more accurately, how any disassembler does it). Would this be an accurate guess?
How does IDA Pro work out where internal functions are?
ida;functions