This command allows the user to rename a stack variable. Enter an identifier for the stack variable and press Enter.
Internally, stack variables are represented as structure fields. IDA creates a new structure type for each function frame.
See also Edit|Structs submenu. How to Enter an Identifier
Navigation band refresh interval (milliseconds)
Convert already defined bytes
Associate .IDB file extension with IDA
Enable autocomplete in forms
Output files encoding
This command resets the state of all questions and messages the user hid by checking the "Don't show this message again" checkbox.
IDA_MINIDUMP (Windows only) If IDA crashes, it creates a minidump file with the MiniDumpWrite(). Use this environment variable to specify MiniDump flags (a combination of MINIDUMP_TYPE flags as a hexadecimal number). If set to "NO", IDA will not write a dump.
IDA_MDMP_INIT (Windows only) Let IDA load dbghlp.dll on startup so it is used for crash dump file generation in case of a crash. If not set, IDA will load dbghlp.dll dynamically (if needed). Using this option may cause the Windbg debugger plugin to malfunction in case its dbghlp.dll does not match the one loaded by IDA.
IDA_NOEH If set, disable IDA's own exception handler and let all possible crashes to be handled by the OS or active debugger. It is useful if you're debugging a crash in a plugin or processor module.
IDAIDS Specifies the directory with the IDS files. Default: %IDADIR%\IDS
IDASGN Specifies the directory with the SIG files. Default: %IDADIR%\SIG
IDATIL Specifies the directory with the TIL files. Default: %IDADIR%\TIL
IDAIDC Specifies the directory with the IDC files. Default: %IDADIR%\IDC
IDA_LIBC_PATH Useful only on Android remote host. Specifies the exact path to the system libc.so
IDA_SKIP_SYMS Useful only on Linux host. Turns off loading of exported symbols for the main executable file at the start of a debugging session
IDA_NONAMES Disables the name resolution
IDA_NO_HISTORY Disables updating file history
IDA_NORELOC Disables processing of the relocation information for some file formats
IDA_NOEXP Disables processing of the export information for some file formats
IDA_NOTLS Disables processing of the TLS entries for some file formats
H8_NOSIZER Disables the display of the operand sizes for H8 module
IDA_LOADALL Load all segments of the input file without further confirmations
IDA_DEBUGBREAKPROCESS (Windows only) IDA debugger will use the DebugBreakProcess() API to break into the process. Otherwise it will instead attempt to set temporary breakpoints for all threads.
IDA_NO_REBASE IDA Debugger will not rebase the program when debugging. (This will be in effect even if the debugger plugin implements the rebase_if_required_to callback)
IDABXPATHMAP Variables related to the Bochs debugger. IDABXENVMAP See plugins/bochs/startup.* for more details.
IDA_NOWIN (Text MS Windows version only) Bypass the code trying to find out the foreground window. This code causes problems under WINE.
IDA_DONT_SWITCH_SCREENS (text version only) Tells IDA to keep only one screen even during local debugging sessions. For local debugging sessions, IDA keeps by default one screen for the debugged application and one screen for itself.
IDA_NOAUTOCOMP Do not autodetect compiler for name demangling. If this variable is absent and the current compiler is one of MS, Borland and Watcom, the compiler is autodetected.
IDA_ELF_PATCH_MODE Overrides patch mode for the new ELF files. If this variable is defined, it must contain a number. Each bit of this number corresponds to an option from the following list:
IDA_DYLD_SHARED_CACHE_SLIDE Mach-O loader: specify the dyld shared cache image ASLR slide value (hexadecimal) or 'search' for automatic detection. If not set, slide is assumed to be 0 (unslid image).
The following variables are used to fine-tune the Linux version of IDA:
TVLOG the name of the log-file if it is not defined, use syslog with LOG_WARNING priority
TERM the terminal definition (see terminfo)
TVHEADLESS disable all output (for i/o redirection) if this variable defined, the TVOPT variable is ignored This environment variable also works also in graphical versions of IDA. When set, the graphical interface will not restore desktops, toolbars or show the main window.
TVOPT the enduser flags. Has many subfields delimited by commas ','. noX11 - when libX11.so is not compatible noGPM - when libgpm.so is not compatible ansi - OR mono - when the terminfo data of your display does not declare it as having the ANSI-color support ign8 - ignore '8bit as meta key' in the terminfo description xtrack - if your xterm-emulator in telnet client does not support mode 1002 (only 1000), set this flag alt866 - do not encode pseudographic symbols (for the console with alt-font loaded) cyrcvt= - cyrilic conversion (oem/koi8r). possible values are: linux - for linux russian users and PuTTY (in/out koi8r) kwin - output in koi8 and input in cp1251 - any telnet windows - for many telnet and any linux users (in/out 1251)
We recommend to use the 'xterm-scokey' terminal type for remote clients.
When the terminal type is xterm-scokey, add the following string to /etc/inputrc (or to ~/.inputrc):
"\e[.": delete char
When working on the console without GPM installed, append "noGPM" to TVOPT.
Russian users should append the following settings to the above:
Sometimes, executable files are shipped in a packed form. It means that to disassemble these files you need to unpack them.
IDA displays this message if the relocation table of the input MZ executable file is empty.
Relocation table has references beyond program limits.
The file being loaded is not completely loaded to memory by the operating system. This may be because:
the file is overlayed; IDA does not know this type of overlays
the file has debugging information attached to its end
the file has other type of information at the end
Anyway, IDA will not load the additional information.
Some EXE files are built with overlays. This means that the whole file is not loaded into the memory at the start of the program, but only a part of it. Other parts are loaded by the program itself into the dynamic memory or over some subroutines of the program. This fact leads to many difficulties when you disassemble such a program.
Currently, IDA knows about overlays created by Borland and Microsoft C and Pascal compilers.
One of the following occurred:
i.e. the input file structure is bad.
When IDA tried to delete bytes outside of any segment, the maximal number of contiguous chunks is reached. This is NOT a fatal error.
Some bytes outside of any segment will be present => the output text will be incorrect because of these bytes. However, you can delete them in the output text using a text editor.
IDA produces executable files only for:
MS DOS .exe
MS DOS .com
MS DOS .drv
MS DOS .sys
general binary
Intel Hex Object Format
MOS Technology Hex Object Format
Furthermore, external loaders may or may not support the creation of user-defined input file formats.
Intel Hex Object Format ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀ This is the default format. This format is line oriented and uses only printable ASCII characters except for the carriage return/line feed at the end of each line. Each line in the file assumes the following format:
Where:
All fields marked 'hex' consist of two or four ASCII hexadecimal digits (0-9, A-F). A maximum of 24 data bytes will be represented on each line.
The last line of the file will be a record conforming to the above format with a byte count of zero (':00000001FF').
The checksum is defined as:
MOS Technology Hex Object Format ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀ This format is line oriented and uses only printable ASCII characters except for the carriage return/line feed at the end of each line. Each line in the file assumes the following format:
Where:
All fields marked 'hex' consist of two or four ASCII hexadecimal digits (0-9, A-F). A maximum of 24 data bytes will be represented on each line.
The last line of the file will be a record with a byte count of zero (';00').
The checksum is defined as:
This command allows you to mark a location so that afterwards you can jump to the marked location immediately. Select any line from the list. The selected line will be used for mark description. Afterwards, you will be able to jump to the marked location using <Alt-J> key.
You can use <Up>, <Down>, <PgUp>, <PgDn>, <Home>, <End> keys. If you select the first line of the list, nothing will be selected.
Press <Enter> to select line, <Esc> to cancel.
See also: How to jump to the marked location
Mark description is any text line. The description is for your information only.
This command allows you to jump to the previously marked location. Select any line. You will jump to the selected location.
You can use <Up>, <Down>, <PgUp>, <PgDn>, <Home>, <End> keys. If you select the first line of the list, nothing will be selected.
Press <Enter> to select line, <Esc> to cancel.
See also: How to mark a location
It might be because of one of the following reasons:
1. The name is ill-formed:
it is a reserved word
IDA does not allow the use of register names as byte names.
it contains bad characters. The list of allowed characters is specified in IDA.CFG
it starts with a reserved prefix. Some prefixes are used by IDA to generate names. See Names Representation dialog for the list of prefixes.
The name is already used in the program. Try to use another name. In order to know where the name is used, you can try to jump to it using Jump to the Named Location
3. The address cannot have a name:
The database is empty or corrupt. Unfortunately, all information has been lost.
Please use a backup copy of the database if there is any.
If you have previously saved your database into a text file, you can load it. See the Dump database command for explanations.
A segment cannot have bytes with negative offset from the segment base. Example: if a segment base is 0x3000, this segment can have a start address above or equal to 0x30000, but it cannot have a start address 0x2FFFF.
Please use an old version of IDA. The current version of IDA does not support this database.
The database was not closed after the last IDA session. Most probably this happened due to a power fault, unexpected reboot of the computer, or another abnormal session termination.
You may try to repair the database but the best solution would be to use the intact packed database or use a backup.
The repairing may fail to recover the database.
See also the Dump database command.
is command allows you to select a name from the user defined names. It means that no such names are defined now, or that all user-defined names are hidden. To give a name to the location, use Rename or [Rename any]../edit/other/rename-any-address.md) commands.
If IDA finds out that your database has an old format, it will try to upgrade the database to a new format. The upgrade process is completely automatic, no user intervention is needed. However, after upgrading your database, you will not be able to work with it using old versions of IDA. That is why IDA asks your confirmation before upgrading the database.
This feature works only for databases starting from IDA version 2.05.
Database format is newer than expected. That is because you are using an old version of IDA. The only thing you can do is to get a new version of IDA.
IDA did not find the specified module in:
the current directory
the operating system directory (see switch -W and configuration file parameters WINDIR,OS2DIR)
Entries imported by ordinal entries will not be commented. If IDA finds a module, all entries that are imported by ordinal will be commented like this:
This comment will be propagated (repeated) to all locations which call this entry:
IDA searches all files named "modulename.*" for the module. If you know that the imported module resides in another directory, copy it to your current directory. If the module file name is different from "modulename.*", rename it. After the database is loaded, you can delete the copied module.
IDA also looks for file "modulename.ids" in the current directory in the IDS subdirectory of the directory where IDA.EXE resides in the PATHed directories
You can create such a file yourself. For an example, look at DOSCALLS.IDS in the IDS subdirectory.
Below is the description of dialog box fields:
If "create imports section" in the file loading dialog is checked, IDA will convert .idata section definitions to "extrn" directives and truncate it so it will not contain empty lines.
Unfortunately, sometimes there is some additional data in .idata section so you'll need to disable this feature if some information is not loaded into the database.
IDA tries to detect additional data in .idata section automatically.
If you disable conversion of .idata section to a segment with "extrn" directives, you will see
somename dd ?
instead of
directives.
Another impact is that the .idata segment will not be truncated in any way.
When you edit the segment boundaries, you can check the "move the adjacent segments" checkbox.
IDA will try to shrink/expand the previous segment in order to move the beginning of the selected segment. Of course, you cannot move the start of the segment 'too far':
You cannot shrink a segment to zero bytes. A segment must have at least one byte.
This command is mostly used when IDA does not detect the boundary between segments correctly.
Sometimes, IDA creates 2 segments where only one segment must exist. In this case, you should not use this command. Use the following sequence instead:
delete one segment. Choose the one with the bad segment base value. Do not disable addresses occupied by the segment being deleted.
change boundaries of the other segment. Caution: moving the first segment of the program will delete all information about the bytes between the old start of the segment and the new start of the segment!
See also another command that changes segment bounds:
Edit|Segments submenu.
If you want to delete the segment, please mark 'CONFIRM DELETION' checkbox
If you disable the addresses occupied by the segment, all information about these addresses will be lost. You will not see them on the screen anymore.
Otherwise, the segment will be deleted, but its data will remain unchanged. You can create another segment(s) for these addresses using Create a New Segment command.
As long as auto analysis is not completed, the IDA database is not consistent:
not all cross-references are found
not all instructions are disassembled
not all data items are explored
See also:
In this mode, IDA will not display dialog boxes on the screen. Instead, it will assume the default answer and proceed. For example, if you press @<Quit>, IDA will promptly exit to OS without asking for any confirmation.
To return to normal mode you will need to execute an IDC function: batch(0); i.e. disable batch "silent" mode. To execute a script command, select File|Script command... menu item or press @<ExecuteLine> hotkey.
IDA maintains separate namespaces for each structure. For example, you can define something like this:
Beware, usually assemblers have one common namespace and do not allow the mentioned above example.
An empty name cannot be specified.
This command is available when you open a structure window.
If the cursor is on the structure name at the beginning of the structure definition, IDA proposes to rename the structure. Otherwise, IDA proposes to rename a structure field.
If a structure is being renamed, the option "Don't include in the list" means that the structure will not be included in the list of the structures which appears when the user applies the structure definition (for example, when the user creates a variable of this structure type). We recommend to mark this checkbox when you have defined all variables of this structure type and want to reduce the number of choices in the list.
See also Edit|Structs submenu. How to Enter an Identifier
See also Edit|Structs submenu.
First of all, you may lose all information because you will not have a backup copy of the database. IDA makes modifications to the unpacked database and if some unexpected condition occurs, the unpacked database is usually damaged. IDA is able to repair this database, but some information could be irreversibly lost, leading to disastrous consequences.
The only advantage of the unpacked database is that it is loaded very fast. the same way, exiting IDA is fast too.
If packing is disabled, the abort command will not be available the next time the database is loaded.
We strongly discourage using unpacked databases.
To disable this prompt in the future, simply modify ASK_EXIT_UNPACKED parameter in IDATUI.CFG or IDAGUI.CFG file.
Please note that when the "File -> Save as" is used with an unpacked database, IDA will continue to use the unpacked database and not the newly created database (the saved as one). In this case, please close and re-open the newly created database to ensure that IDA will use it instead of the original database.
Although the database exists, it is empty. Please delete it and start over.
If you have previously saved your database into a text file, you can load it. See Dump database command for explanations.
See also IDA usage help
Not all switches can be used when you start IDA for the second or more time. Below are valid switches: -a disable auto analysis -d debug
See also IDA usage help
IDA has tried to find a file with the extensions mentioned in the IDA.CFG file, but could not find anything.
The default extension table looks like this:
See also IDA usage help
Some bytes in program memory have no corresponding byte in the executable file. For example, uninitialized data is not kept in the file. OS/2 Warp and Window support compressed pages.
In this case, IDA cannot create a full difference file. It shows the skipped byte addresses along with their values in the message window.
You can use list viewer commands in this window. Here is the format of this window.
Some commands cannot be applied to the addresses without a segment.
Create a segment first. You can do this using the CreateSegment command.
The input file doesn't contain any instructions or data, i.e. there is nothing to disassemble.
Some file formats allow the situation when the file is not empty but it doesn't contain anything to disassemble. For example, COFF/OMF/EXE formats could contain a file header which just declares that there are no executable sections in the file.
There could be type information, compiler options and other auxiliary information in the file. This is the reason why the file doesn't look empty but IDA doesn't find anything to disassemble.
Below is the description of dialog box fields:
If a byte has relocation information attached to it, then the value of this byte is changed when the file is loaded into the memory by the system loader or linker. Therefore, it doesn't make much sense (and sometimes it is simply illegal) to modify the byte.
We recommend to return the original value of the byte(s).
You can see the relocation information attached to an item by using the show internal flags command.
The most probable error is that you tried to use an incompatible version of IDA. Starting from IDA 2.0 beta2 the format of virtual files was changed.
The most probable error is that you tried to open database with old version of IDA. Please use newer version of IDA to open this database.
This error happens because of the database corruption. Try to finish your work as soon as possible and generate the text source file.
The best choice would be to restore from a backup because the database is corrupted.
This submenu allows you to manipulate windows on the screen. You can also:
(text version)
(text version)
See also submenus.
This command changes the current video mode. The list of allowed video modes is kept in the IDATUI.CFG file, the SCREEN_MODES parameter.
Please note that there are two instances in this variable: one for MS-DOS and another for Windows.
If you use the MS DOS version, you need to specify the screen mode numbers valid for you video card in SCREEN_MODES. Otherwise, this command will not work.
This command invokes an external help.
In the MS Windows version of IDA, it starts WinHelp with the parameter taken from the cursor location.
The HELPFILE parameter in IDATUI.CFG/IDAGUI.CFG points to the help file name.
This command displays the current keyboard layout.
You can change the layout in the configuration file
This command is available in the text version only.