Q:

Point-to analysis of IDA Pro

I am aware that many users on this forum are experts (developers) of IDA Pro. So I am tentatively inquiring some high-level ideas behind the point-to analysis of IDA Pro.
According to my personal experience (I have been using IDA Pro 6.95 a lot for my binary code research), the point-to analysis implemented in IDA Pro is neither sound or complete. I am envisioning some heuristics are utilized to infer the value set in the code and data pointers. 
So here is my question:

Could anyone shed a light on the point-to algorithm in IDA-Pro? I understood IDA-Pro is a commercial software so a high-level idea would be very much appreciated.
What is the best practice to build a call graph with IDA Pro, considering we have decent amount of indirect calls which needs to be interred. 

The analysis platform could be ELF binaries on ARM, which seems relatively easier, comparing to x86.

A:

The topic of pointer analysis is an important part of theoretical static analysis. Many articles and academic publications have been written about pointer analysis, this is a heavily researched field.
Besides the theoretical research, it is often an difficult issue to address even by skilled and trained reverse engineers. In certain cases it can be nearly impossible to retrieve the pointer without executing or emulating the relevant code.
Therefore, for IDA Pro to provide a "sound and complete" solution, as you put it, is not a trivial task. This is highlighted by the fact this isn't really the disassembler's task.
As for your specific questions:

Could anyone shed a light on the point-to algorithm in IDA-Pro? I understood IDA-Pro is a commercial software so a high-level idea would be very much appreciated.

As far as I'm aware, IDA's pointer analysis is quite basic. Register calls are only resolved if they're directly assigned and there's isn't a lot of taint analysis. It is important to remember IDA is not a binary static analysis tool, IDA is a disassembler (and a decompiler). Taint analysis, constraint solving, call graph analysis etc are usually better done by tools designed specifically for those purposes. Having said that, IDA does make an effort to include heuristics to help with that type of thing.

What is the best practice to build a call graph with IDA Pro, considering we have decent amount of indirect calls which needs to be interred.

So again, IDA isn't the best tool to build a call graph if you're mostly focused on those cases where call targets are difficult to resolve or there are plenty of constraints to consider.
There are better tools for static binary analysis, as well as several questions about the topic here over RE.SO. My personal favorite is probably angr.
I suggest you spend time researching the theoretical topic and available tools and approaches before going forward. 

