Various dialog help messages

• Packed Files

• Bad Relocation Table

• Additional information at the end of file

• Overlayed files

• Error loading overlays

• Maximal number of segments is reached

• Cannot generate executable file

• Bad input file format

• Choose mark number

• Enter mark description

• Choose marked location

• IDA View bookmarks

• Structs bookmarks

• Enums bookmarks

• Cannot Rename a Byte

• Cannot find file segmentation

• Negative Offsets

• DataBase is not closed

• Obsolete Database Format

• The Name List is Empty

• Upgrading IDA database

• Unexpected Database Format

• Imported module is not found

• Load file dialog

• PE .idata section has additional data

• Repeat search for instruction/data with the specified operand

• Repeat search for substring in the disassembly

• Repeat search for substring in the file

• Moving Segment

• Deleting a Segment

• Auto analysis is not completed

• Silent mode of IDA

• Rename a structure/member

• Delete a structure member

• Unpacked database is dangerous

• Database Is Empty

• Illegal Usage of the Switch

• Cannot Find Input File

• Patched Bytes Are Skipped

• Patched bytes have relocation information

• No Segment for the current byte

• Empty Program

• Load additional binary file

• Patching Relocation Bytes

• NotVaFile

• VaTooHighVersion

• Desktops

• Can't create segment registers range

• Cannot assign to Segment Register

Packed Files

Sometimes, executable files are shipped in a packed form. It means that to disassemble these files you need to unpack them.

IDA displays this message if the relocation table of the input MZ executable file is empty.

Bad Relocation Table

Relocation table has references beyond program limits.

Additional information at the end of file

The file being loaded is not completely loaded to memory by the operating system. This may be because:

• the file is overlayed; IDA does not know this type of overlays

• the file has debugging information attached to its end

• the file has other type of information at the end

Anyway, IDA will not load the additional information.

Overlayed files

Some EXE files are built with overlays. This means that the whole file is not loaded into the memory at the start of the program, but only a part of it. Other parts are loaded by the program itself into the dynamic memory or over some subroutines of the program. This fact leads to many difficulties when you disassemble such a program.

Currently, IDA knows about overlays created by Borland and Microsoft C and Pascal compilers.

Error loading overlays

One of the following occurred:

        - overlay stub is not found
        - overlay relocation data is incorrect

i.e. the input file structure is bad.

Maximal number of segments is reached

When IDA tried to delete bytes outside of any segment, the maximal number of contiguous chunks is reached. This is NOT a fatal error.

Some bytes outside of any segment will be present => the output text will be incorrect because of these bytes. However, you can delete them in the output text using a text editor.

Cannot generate executable file

IDA produces executable files only for:

• MS DOS .exe

• MS DOS .com

• MS DOS .drv

• MS DOS .sys

• general binary

• Intel Hex Object Format

• MOS Technology Hex Object Format

Furthermore, external loaders may or may not support the creation of user-defined input file formats.

Bad input file format

The input file does not conform to the following definitions:

Intel Hex Object Format ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀ This is the default format. This format is line oriented and uses only printable ASCII characters except for the carriage return/line feed at the end of each line. Each line in the file assumes the following format:

 :NNAAAARRHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHCCTT

Where:

All fields marked 'hex' consist of two or four ASCII hexadecimal digits (0-9, A-F). A maximum of 24 data bytes will be represented on each line.

 :      = Record Start Character
 NN     = Byte Count (hex)
 AAAA   = Address of first byte (hex)
 RR     = Record Type (hex, 00 except for last record which is 01)
 HH     = Data Bytes (hex)
 CC     = Check Sum (hex)
 TT     = Line Terminator (carriage return, line feed)

The last line of the file will be a record conforming to the above format with a byte count of zero (':00000001FF').

The checksum is defined as:

        sum      =  byte_count + address_hi + address_lo +
                        record_type + (sum of all data bytes)
        checksum =  ((-sum) & ffh)

MOS Technology Hex Object Format ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀ This format is line oriented and uses only printable ASCII characters except for the carriage return/line feed at the end of each line. Each line in the file assumes the following format:

 ;NNAAAAHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHCCCCTT

Where:

All fields marked 'hex' consist of two or four ASCII hexadecimal digits (0-9, A-F). A maximum of 24 data bytes will be represented on each line.

 ;      = Record Start Character
 NN     = Byte Count (hex)
 AAAA   = Address of first byte (hex)
 HH     = Data Bytes (hex)
 CCCC   = Check Sum (hex)
 TT     = Line Terminator (carriage return, line feed)

The last line of the file will be a record with a byte count of zero (';00').

The checksum is defined as:

        sum      =  byte_count + address_hi + address_lo +
                        (sum of all data bytes)
        checksum =  (sum & ffffh)

Choose mark number

This command allows you to mark a location so that afterwards you can jump to the marked location immediately. Select any line from the list. The selected line will be used for mark description. Afterwards, you will be able to jump to the marked location using <Alt-J> key.

You can use <Up>, <Down>, <PgUp>, <PgDn>, <Home>, <End> keys. If you select the first line of the list, nothing will be selected.

Press <Enter> to select line, <Esc> to cancel.

See also: How to jump to the marked location

Enter mark description

Mark description is any text line. The description is for your information only.

Choose marked location

This command allows you to jump to the previously marked location. Select any line. You will jump to the selected location.

You can use <Up>, <Down>, <PgUp>, <PgDn>, <Home>, <End> keys. If you select the first line of the list, nothing will be selected.

Press <Enter> to select line, <Esc> to cancel.

See also: How to mark a location

IDA View bookmarks

See: Choose marked location

Structs bookmarks

See: Choose marked location

Enums bookmarks

See: Choose marked location

Cannot rename a location

It might be because of one of the following reasons:

1. The name is ill-formed:

• it is a reserved word

IDA does not allow the use of register names as byte names.

• it contains bad characters. The list of allowed characters is specified in IDA.CFG

• it starts with a reserved prefix. Some prefixes are used by IDA to generate names. See Names Representation dialog for the list of prefixes.

1. The name is already used in the program. Try to use another name. In order to know where the name is used, you can try to jump to it using Jump to the Named Location

3. The address cannot have a name: