Sometimes, executable files are shipped in a packed form. It means that to disassemble these files you need to unpack them.
IDA displays this message if the relocation table of the input MZ executable file is empty.
Relocation table has references beyond program limits.
The file being loaded is not completely loaded to memory by the operating system. This may be because:
the file is overlayed; IDA does not know this type of overlays
the file has debugging information attached to its end
the file has other type of information at the end
Anyway, IDA will not load the additional information.
Some EXE files are built with overlays. This means that the whole file is not loaded into the memory at the start of the program, but only a part of it. Other parts are loaded by the program itself into the dynamic memory or over some subroutines of the program. This fact leads to many difficulties when you disassemble such a program.
Currently, IDA knows about overlays created by Borland and Microsoft C and Pascal compilers.
One of the following occurred:
i.e. the input file structure is bad.
When IDA tried to delete bytes outside of any segment, the maximal number of contiguous chunks is reached. This is NOT a fatal error.
Some bytes outside of any segment will be present => the output text will be incorrect because of these bytes. However, you can delete them in the output text using a text editor.
IDA produces executable files only for:
MS DOS .exe
MS DOS .com
MS DOS .drv
MS DOS .sys
general binary
Intel Hex Object Format
MOS Technology Hex Object Format
Furthermore, external loaders may or may not support the creation of user-defined input file formats.
Intel Hex Object Format ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀ This is the default format. This format is line oriented and uses only printable ASCII characters except for the carriage return/line feed at the end of each line. Each line in the file assumes the following format:
Where:
All fields marked 'hex' consist of two or four ASCII hexadecimal digits (0-9, A-F). A maximum of 24 data bytes will be represented on each line.
The last line of the file will be a record conforming to the above format with a byte count of zero (':00000001FF').
The checksum is defined as:
MOS Technology Hex Object Format ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀ This format is line oriented and uses only printable ASCII characters except for the carriage return/line feed at the end of each line. Each line in the file assumes the following format:
Where:
All fields marked 'hex' consist of two or four ASCII hexadecimal digits (0-9, A-F). A maximum of 24 data bytes will be represented on each line.
The last line of the file will be a record with a byte count of zero (';00').
The checksum is defined as:
This command allows you to mark a location so that afterwards you can jump to the marked location immediately. Select any line from the list. The selected line will be used for mark description. Afterwards, you will be able to jump to the marked location using <Alt-J> key.
You can use <Up>, <Down>, <PgUp>, <PgDn>, <Home>, <End> keys. If you select the first line of the list, nothing will be selected.
Press <Enter> to select line, <Esc> to cancel.
See also: How to jump to the marked location
Mark description is any text line. The description is for your information only.
This command allows you to jump to the previously marked location. Select any line. You will jump to the selected location.
You can use <Up>, <Down>, <PgUp>, <PgDn>, <Home>, <End> keys. If you select the first line of the list, nothing will be selected.
Press <Enter> to select line, <Esc> to cancel.
See also: How to mark a location
It might be because of one of the following reasons:
1. The name is ill-formed:
it is a reserved word
IDA does not allow the use of register names as byte names.
it contains bad characters. The list of allowed characters is specified in IDA.CFG
it starts with a reserved prefix. Some prefixes are used by IDA to generate names. See Names Representation dialog for the list of prefixes.
The name is already used in the program. Try to use another name. In order to know where the name is used, you can try to jump to it using Jump to the Named Location
3. The address cannot have a name:
The database is empty or corrupt. Unfortunately, all information has been lost.
Please use a backup copy of the database if there is any.
If you have previously saved your database into a text file, you can load it. See the Dump database command for explanations.
A segment cannot have bytes with negative offset from the segment base. Example: if a segment base is 0x3000, this segment can have a start address above or equal to 0x30000, but it cannot have a start address 0x2FFFF.
Please use an old version of IDA. The current version of IDA does not support this database.
The database was not closed after the last IDA session. Most probably this happened due to a power fault, unexpected reboot of the computer, or another abnormal session termination.
You may try to repair the database but the best solution would be to use the intact packed database or use a backup.
The repairing may fail to recover the database.
See also the Dump database command.
is command allows you to select a name from the user defined names. It means that no such names are defined now, or that all user-defined names are hidden. To give a name to the location, use Rename or [Rename any]../edit/other/rename-any-address.md) commands.
If IDA finds out that your database has an old format, it will try to upgrade the database to a new format. The upgrade process is completely automatic, no user intervention is needed. However, after upgrading your database, you will not be able to work with it using old versions of IDA. That is why IDA asks your confirmation before upgrading the database.
This feature works only for databases starting from IDA version 2.05.
Database format is newer than expected. That is because you are using an old version of IDA. The only thing you can do is to get a new version of IDA.
IDA did not find the specified module in:
the current directory
the operating system directory (see switch -W and configuration file parameters WINDIR,OS2DIR)
Entries imported by ordinal entries will not be commented. If IDA finds a module, all entries that are imported by ordinal will be commented like this:
This comment will be propagated (repeated) to all locations which call this entry:
IDA searches all files named "modulename.*" for the module. If you know that the imported module resides in another directory, copy it to your current directory. If the module file name is different from "modulename.*", rename it. After the database is loaded, you can delete the copied module.
IDA also looks for file "modulename.ids" in the current directory in the IDS subdirectory of the directory where IDA.EXE resides in the PATHed directories
You can create such a file yourself. For an example, look at DOSCALLS.IDS in the IDS subdirectory.
Below is the description of dialog box fields:
If "create imports section" in the file loading dialog is checked, IDA will convert .idata section definitions to "extrn" directives and truncate it so it will not contain empty lines.
Unfortunately, sometimes there is some additional data in .idata section so you'll need to disable this feature if some information is not loaded into the database.
IDA tries to detect additional data in .idata section automatically.
If you disable conversion of .idata section to a segment with "extrn" directives, you will see
somename dd ?
instead of
directives.
Another impact is that the .idata segment will not be truncated in any way.
When you edit the segment boundaries, you can check the "move the adjacent segments" checkbox.
IDA will try to shrink/expand the previous segment in order to move the beginning of the selected segment. Of course, you cannot move the start of the segment 'too far':
You cannot shrink a segment to zero bytes. A segment must have at least one byte.
This command is mostly used when IDA does not detect the boundary between segments correctly.
Sometimes, IDA creates 2 segments where only one segment must exist. In this case, you should not use this command. Use the following sequence instead:
delete one segment. Choose the one with the bad segment base value. Do not disable addresses occupied by the segment being deleted.
change boundaries of the other segment. Caution: moving the first segment of the program will delete all information about the bytes between the old start of the segment and the new start of the segment!
See also another command that changes segment bounds:
Edit|Segments submenu.
If you want to delete the segment, please mark 'CONFIRM DELETION' checkbox
If you disable the addresses occupied by the segment, all information about these addresses will be lost. You will not see them on the screen anymore.
Otherwise, the segment will be deleted, but its data will remain unchanged. You can create another segment(s) for these addresses using Create a New Segment command.
As long as auto analysis is not completed, the IDA database is not consistent:
not all cross-references are found
not all instructions are disassembled
not all data items are explored
See also:
In this mode, IDA will not display dialog boxes on the screen. Instead, it will assume the default answer and proceed. For example, if you press @<Quit>, IDA will promptly exit to OS without asking for any confirmation.
To return to normal mode you will need to execute an IDC function: batch(0); i.e. disable batch "silent" mode. To execute a script command, select File|Script command... menu item or press @<ExecuteLine> hotkey.
IDA maintains separate namespaces for each structure. For example, you can define something like this:
Beware, usually assemblers have one common namespace and do not allow the mentioned above example.
An empty name cannot be specified.
This command is available when you open a structure window.
If the cursor is on the structure name at the beginning of the structure definition, IDA proposes to rename the structure. Otherwise, IDA proposes to rename a structure field.
If a structure is being renamed, the option "Don't include in the list" means that the structure will not be included in the list of the structures which appears when the user applies the structure definition (for example, when the user creates a variable of this structure type). We recommend to mark this checkbox when you have defined all variables of this structure type and want to reduce the number of choices in the list.
See also Edit|Structs submenu. How to Enter an Identifier
See also Edit|Structs submenu.
First of all, you may lose all information because you will not have a backup copy of the database. IDA makes modifications to the unpacked database and if some unexpected condition occurs, the unpacked database is usually damaged. IDA is able to repair this database, but some information could be irreversibly lost, leading to disastrous consequences.
The only advantage of the unpacked database is that it is loaded very fast. the same way, exiting IDA is fast too.
If packing is disabled, the abort command will not be available the next time the database is loaded.
We strongly discourage using unpacked databases.
To disable this prompt in the future, simply modify ASK_EXIT_UNPACKED parameter in IDATUI.CFG or IDAGUI.CFG file.
Please note that when the "File -> Save as" is used with an unpacked database, IDA will continue to use the unpacked database and not the newly created database (the saved as one). In this case, please close and re-open the newly created database to ensure that IDA will use it instead of the original database.
Although the database exists, it is empty. Please delete it and start over.
If you have previously saved your database into a text file, you can load it. See Dump database command for explanations.
See also IDA usage help
Not all switches can be used when you start IDA for the second or more time. Below are valid switches: -a disable auto analysis -d debug
See also IDA usage help
IDA has tried to find a file with the extensions mentioned in the IDA.CFG file, but could not find anything.
The default extension table looks like this:
See also IDA usage help
Some bytes in program memory have no corresponding byte in the executable file. For example, uninitialized data is not kept in the file. OS/2 Warp and Window support compressed pages.
In this case, IDA cannot create a full difference file. It shows the skipped byte addresses along with their values in the message window.
You can use list viewer commands in this window. Here is the format of this window.
Some commands cannot be applied to the addresses without a segment.
Create a segment first. You can do this using the CreateSegment command.
The input file doesn't contain any instructions or data, i.e. there is nothing to disassemble.
Some file formats allow the situation when the file is not empty but it doesn't contain anything to disassemble. For example, COFF/OMF/EXE formats could contain a file header which just declares that there are no executable sections in the file.
There could be type information, compiler options and other auxiliary information in the file. This is the reason why the file doesn't look empty but IDA doesn't find anything to disassemble.
Below is the description of dialog box fields:
If a byte has relocation information attached to it, then the value of this byte is changed when the file is loaded into the memory by the system loader or linker. Therefore, it doesn't make much sense (and sometimes it is simply illegal) to modify the byte.
We recommend to return the original value of the byte(s).
You can see the relocation information attached to an item by using the show internal flags command.
The most probable error is that you tried to use an incompatible version of IDA. Starting from IDA 2.0 beta2 the format of virtual files was changed.
The most probable error is that you tried to open database with old version of IDA. Please use newer version of IDA to open this database.
This error happens because of the database corruption. Try to finish your work as soon as possible and generate the text source file.
The best choice would be to restore from a backup because the database is corrupted.