LogoLogo
IDA 9.0
IDA 9.0
  • Welcome to Hex-Rays docs
    • What's new?
  • Getting Started
    • Install IDA
    • Licensing
    • Basic Usage
    • What's next?
  • User Guide
    • User Interface
      • Menu Bar
        • File
          • Load file
          • Script File
          • Script command
          • Produce output files
          • Invoke OS Shell
          • Take database snapshot
          • Save database
          • Save database as...
          • Abort IDA
          • Exit IDA
        • Edit
          • Export data
          • Undo an action
          • Redo an action
          • Clear undo history
          • Disable undo
          • Convert to instruction
          • Convert to data
          • Convert to string literal
          • Convert to array
          • Undefine a byte
          • Give Name to the Location
          • Operand types
            • Offset
            • Number
            • Perform en masse operation
            • Convert operand to character
            • Convert operand to segment
            • Complex Offset Expression
            • Convert operand to symbolic constant (enum)
            • Convert operand to stack variable
            • Change operand sign
            • Bitwise negate operand
            • User-defined operand
            • Set operand type
          • Comments
          • Functions
          • Structs
          • Segments
          • Patch core
          • Other
            • Rename Any Address
          • Plugins
        • Jump
          • Center current line in window
          • Problems List
        • Search
          • REGULAR EXPRESSION SYNTAX SUMMARY
        • View
          • Open subviews
          • Graphs
          • Message Window
          • Arrows window
          • Database snapshot manager
          • Highlighting identifiers
          • Browser options
          • Lumina options
          • Assembler level and C level types
          • C++ type details
          • Bookmarks window
          • Calculator
          • View segment registers
          • View Internal Flags
          • Hide
          • Unhide
          • Del hidden range
          • Hide all items
          • Unhide all items
          • Setup hidden items
        • Debugger
          • Debugger window
          • Process Control
            • Start process
            • Process options
            • Pause process
            • Terminate process
            • Step into
            • Step over
            • Run to cursor
            • Run until return
            • Attach to process
            • Detach from process
            • Set current ip
            • Show application screen
          • Breakpoints
          • Watches
          • Tracing
          • Source code view
            • Watch view (source level)
          • Process Memory
            • Take memory snapshot
            • Manual memory regions
            • Refresh memory
          • Thread list
          • Module list
          • Stack trace
          • Exceptions
          • Debugger options
          • Switch debugger
        • Lumina
        • Options
          • Low & High Suspicious Operand Limits
        • Windows
          • Rename a stack variable
          • Miscellanous Options
          • Environment variables
          • Reset Hidden Messages
          • Various dialog help messages
        • List of all menu options
      • Desktops
      • Command line
      • How To Use List Viewers in IDA
      • Licenses
        • Apache License for Ghidra
        • Apache License for LLVM
        • Common Public License Version 1.0
        • APPLE PUBLIC SOURCE LICENSE
        • PCRE2 LICENCE
        • GNU Lesser General Public License v2.1 for libiberty
      • Database conversion from idb to i64
    • Disassembler
      • Interactivity
      • Background Analysis
      • Graph view
        • Graphing tutorial
      • Proximity view
      • Navigation
        • Anchor
        • How to Enter a Segment Value
        • How to Enter a Number
        • How to Enter an Identifier
        • How to enter text
        • How to Enter an Address
      • Disassembly Gallery
        • Philips 51XA-G3
        • 6502 and 65C02 Disassembler
        • 6301, 6303, 6800, 6801 and 6803 Disassembler
        • 68040, Amiga
        • 6805 Disassembler
        • 6808 Disassembler
        • 6809 OS9 Flex Disassembler
        • 6809 Disassembler
        • 6811 Disassembler
        • 68HC12 Disassembler
        • 68HC16 Disassembler
        • 68k Amiga Disassembler
        • 68k Mac OS
        • 68k Palm Pilot
        • Unix COFF
        • NEC 78k0 and 78k0s Processor
        • 80196 Processor
        • 8051 Disassembler
        • Analog Devices 218x.
        • Alpha Processor – NT COFF
        • Alpha Processor – Unix ELF
        • Android ARM Executables (.elf)
        • ARC Processor
        • ARM Processor EPOC App
        • ARM Processor EPOC PE File
        • ARM Processor EPOC ROMFile
        • EPOC SIS File Handler
        • ARM Processor iOS (iPhone): Unlock
        • ARM Processor iOS (iPhone): Objective-C metadata
        • ARM Processor iOS (iPhone): Objective-C Instance variables
        • ARM Processor iOS (iPhone): Parameter Identification & Tracking (PIT)
        • ARM Processor iOS (iPhone): Start
        • ARM Processor iOS (iPhone): Switch statements
        • ARM Processor iOS (iPhone): C++ signatures
        • ARM Processor iOS (iPhone): Write
        • ARM Processor: Linux ELF
        • ARM Processor: AOF SDK
        • ARM Processor: Windows CE COFF Format
        • ARM Processor: Windows CE PE Format
        • ATMEL AVR Disassembler
        • C166 Processor
        • C166 Processor with ELF file
        • Rockwell C39
        • Microsoft .NET CLI Disassembler. VisualBasic library
        • CR16
        • Android Dalvik Executables (.dex)
        • Microsoft .NET CLI Disassembler
        • DSP56K
        • Fujitsu FR (.elf)
        • Gameboy
        • H8 300: COFF FILE Format
        • H8 300s: COFF FILE Format
        • H8 500
        • HPPA Risc Processor: HP-UX SOM
        • i51
        • i860
        • Intel i960
        • Intel IA-64 (Itanium)
        • Java Bytecode
        • Angstrem KR 1878
        • Renesas/Hitachi M16C
        • Renesas/Hitachi M32R
        • M740
        • M7700
        • M7900
        • MIPS Processor: Nintendo N64
        • MIPS R5900 Processor : Sony bin
        • MIPS Processor: Sony ELF
        • MIPS Processor: Sony PSX
        • MIPS Processor: Sony PSX
        • MIPS Processor: Unix COFF File Format
        • MIPS Processor: Unix ELF File Format
        • MIPS Processor: Windows CE PE File Format
        • MIPS Processor: Windows CE PE2 File Format
        • Panasonic MN102
        • Atmel OAK DSP
        • 80×86 Architecture: DOS Extender
        • 80×86 Architecture: Watcom Runtime
        • 80×86 Architecture: Geos APP
        • 80×86 Architecture: Geos DRV
        • 80×86 Architecture: Geos LIB
        • 80×86 Architecture: GNU COFF Format
        • 80×86 Architecture: OS/2 Linear Executable Format
        • 80×86 Architecture: Netware NLM
        • 80×86 Architecture: QNX Executable
        • 80×86 Architecture: Watcom Runtime
        • 80×86 Architecture: Windows OMF
        • 80×86 Architecture: Windows Portable Executable Format
        • 80×86 Architecture: Windows Virtual Device Driver
        • 80×86 Architecture: Windows 16 bits DLL
        • X-Box Disassembler
        • PDP 11: SAV File
        • PIC
        • PIC 12xx
        • Power PC AIF ECOFF file Format
        • Power PC Linux ELF
        • Mac OS PEF File
        • Mac OS X File
        • Windows NT PE File
        • Hitachi SH-1 Processor
        • Hitachi SH-3 Processor: Windows CE COFF format
        • Hitachi SH-3 Processor: Windows CE PE format
        • Hitachi SH-4 Processor: ELF File Format
        • Hitachi SH-4 Processor: Windows CE PE File Format
        • Super Nintendo Entertainement System (SNES)
        • SPARC Solaris COFF
        • SPARC Solaris ELF
        • SPARC Sun ELF
        • SPARC Sun ELF SO
        • ST 20C4
        • ST 7
        • ST 9
        • Toshiba TLCS 900
        • TMS 320c2 COFF
        • TMS 320c5
        • TMS 320c54
        • TMS 320c6 COFF File Format
        • TRICORE
        • SunPlus unSP
        • NEC V850
        • Z180 COFF File Format
        • Z380 COFF File Format
        • Z8
        • Z80
      • Supported processors
      • Supported file formats
        • Windmp file loader
      • Bitfields
        • Bit Fields tutorial
      • Structures tutorial
      • Union tutorial
      • Variable length structures tutorial
      • Data types, operands and constructs
      • Packed executables
    • Decompiler
      • Prerequisites
      • Quick primer
      • Exception handler
      • Introduction to Decompilation vs. Disassembly
        • Comparisons of ARM disassembly and decompilation
        • Comparisons of PowerPC disassembly and decompilation
        • Comparisons of MIPS disassembly and decompilation
        • Hex-Rays v7.4 vs. v7.3 Decompiler Comparison Page
        • Hex-Rays v7.3 vs. v7.2 Decompiler Comparison Page
        • Hex-Rays v7.2 vs. v7.1 Decompiler Comparison Page
      • Interactive operation
        • Rename
        • Set type
        • Set number representation
        • Edit indented comment
        • Edit block comment
        • Hide/unhide C statements
        • Split/unsplit expression
        • Force call type
        • Set call type
        • Add/del variadic arguments
        • Del function argument
        • Add/delete function return type
        • Jump to cross reference
        • Jump to cross reference globally
        • Generate HTML file
        • Mark/unmark as decompiled
        • Copy to assembly
        • Show/hide casts
        • Reset pointer type
        • Convert to struct *
        • Create new struct type
        • Split variable
        • Select union field
        • Jump to paired paren
        • Collapse/uncollapse item
        • Map to another variable
      • Batch operation
      • Configuration
      • Third party plugins
      • Floating point support
      • Support for intrinsic functions
      • Overlapped variables
      • gooMBA
      • Failures and troubleshooting
      • FAQ
      • Limitations
      • Tips and tricks
    • Debugger
      • Instant debugger
      • Remote debugging
        • Remote iOS Debugger
        • Android debugger
        • Dalvik debugger
        • Remote GDB Debugger
          • Remote GDB Debugger options
          • Debugging with gdbserver
          • Debugging with VMWare
          • Debugging with OpenOCD
          • Debugging with QEMU
          • External programs and GDB Debugger
          • Debugging code snippets with QEMU
        • PIN debugger
          • Building the PIN tool
          • Connecting a remote PIN tool instance from IDA
          • PIN support for MacOSX
        • Replayer debugger
        • Bochs debugger
          • Bochs Disk Image operation mode
          • Bochs IDB operation mode
          • Bochs PE operation mode
          • Bochs debugger FAQ
      • Local debugging
        • WinDbg Debugger
        • Linux debugger
        • Intel/ARM macOS debugger
      • Debugger tutorials
        • Debugging Dalvik Programs
        • IDA Win32 Local Debugging
        • IDA Linux Local Debugging
        • IDA Linux to Win64 Debugging
        • IDA Win32 to Linux Debugging
        • Debugging Mac OSX Applications with IDA Pro
        • Debugging iOS Applications using CoreDevice (iOS 17 and up)
        • Debugging iOS Applications with IDA Pro
        • Debugging Linux Applications locally
        • Debugging Linux/Windows Applications with PIN Tracer module
        • Debugging Windows Applications with IDA Bochs Plugin
        • Debugging Windows Applications with IDA WinDbg Plugin
        • Using the Bochs debugger plugin in Linux
        • Debugging Windows Kernel with VMWare and IDA WinDbg Plugin
        • Debugging Linux Kernel under VMWare using IDA GDB debugger
        • Windows Debugger Hub
        • Linux Debugger
        • Debugging a Windows executable locally and remotely
        • Debugging the XNU Kernel with IDA Pro
        • Remote debugging with IDA Pro
        • IDA Scriptable Debugger: overview
          • IDA Scriptable Debugger: scriptability
        • Debugging code snippets with QEMU debugger (a la IDA Bochs debugger)
        • Trace Replayer and managing traces
        • Using IDA Pro's tracing features
        • Working with PIN
        • Appcall
    • Creating Signatures
      • FLIRT
        • IDA F.L.I.R.T. Technology: In-Depth
        • Generate FLIRT signature file
        • Supported Compilers
          • Turbo Pascal
          • Delphi
      • Makesig
    • Creating Type Libraries
      • IDAClang
      • TILIB
    • Configuration
      • Configuration files
      • Command line switches
      • Keyboard macros
      • UI/Fonts/Themes
      • Shortcuts
      • Customizing IDA
      • CSS-based styling
    • Teams
      • IDA Teams Licenses
      • Diffing and Merging Databases with IDA Teams
      • Teams lc command reference manual
      • hv command reference manual
      • Hex-Rays Vault’s visual client user manual
    • Lumina
      • lc command reference manual
    • Plugins
      • Open Plugin Architecture
      • Plugin options
      • Plugins Shipped with IDA
        • Swift plugin
        • Golang plugin
        • Rust plugin
        • picture_search
        • Objective-C Analysis Plugin
        • DYLD Shared Cache Utils
        • Borland RTTI descriptors plugin
        • DWARF plugin
        • Patfind plugin
        • IDA Feeds
          • FLIRT Signature Bundle
      • Plugin Contest
      • How to write your own plugin?
    • Helper Tools
    • idalib
  • Developer Guide
    • C++ SDK
      • Getting Started with C++ SDK
      • C++ SDK Reference
      • Using the Decompiler SDK: Decompiler plugin
      • C++ SDK examples
      • How to create a plugin in C++?
      • C++ SDK Porting Guide from IDA 8.x to 9.0
    • IDAPython
      • Getting started with IDAPython
      • IDAPython API Reference
      • IDAPython examples
      • How to create a plugin in IDAPython?
      • IDAPython Porting Guide from IDA 8.x to 9.0
    • IDC
      • Core concepts
        • Expressions
        • Statements
        • Functions
        • Variables
        • Constants
        • Exceptions
        • Classes
        • Predefined symbols
        • loader_input_t class
        • Slices
      • IDC API Reference
        • Index of debugger related IDC functions
        • Alphabetical list of IDC functions
          • is_member_id
          • load_type
          • get_member_by_idx
          • get_ordinal_limit
          • set_selector
          • enable_tracing
          • get_prev_fixup_ea
          • del_segm
          • get_bmask_cmt
          • end_type_updating
          • Find
          • toggle_bnot
          • patch_byte
          • get_module_info
          • set_member_name
          • create_float
          • del_struc_member
          • read_dbg_memory
          • get_enum_width
          • getn_thread_name
          • del_struc
          • filelength
          • set_manual_insn
          • is_value...() functions
          • get_ip_val
          • del_extra_cmt
          • create_insn
          • op_offset_high16
          • get_cmt
          • expand_struc
          • get_idb_path
          • set_frame_size
          • get_file_ext
          • has_value
          • readshort
          • sanitize_file_name
          • get_member_flag
          • create_struct
          • ARM specific
          • set_enum_member_cmt
          • rename
          • set_ida_state
          • get_member_size
          • msg
          • qbasename
          • get_enum_member_enum
          • auto_mark_range
          • plan_to_apply_idasgn
          • set_named_type
          • op_offset
          • rename_entry
          • strlen
          • get_extra_cmt
          • get_enum_flag
          • fgetc
          • op_stkvar
          • get_last_index
          • get_field_ea
          • get_struc_id
          • select_thread
          • create_array
          • get_struc_cmt
          • set_array_string
          • set_func_attr
          • set_storage_type
          • get_struc_size
          • demangle_name
          • get_next_fixup_ea
          • get_next_bmask
          • delattr
          • gen_simple_call_chart
          • patch_qword
          • get_enum_name
          • loader_input_t.getc
          • get_debugger_event_cond
          • read_dbg_qword
          • define_local_var
          • generate_disasm_line
          • add_idc_hotkey
          • tolower
          • del_selector
          • set_debugger_event_cond
          • get_imagebase
          • gen_file
          • get_entry
          • find_custom_data_format
          • get_debug_name_ea
          • add_default_til
          • set_func_end
          • exit_process
          • delete_array
          • xtol
          • get_exception_code
          • detach_process
          • set_enum_cmt
          • get_wide_word
          • put_bookmark
          • is_loaded
          • add_enum_member
          • parse_decls
          • readstr
          • get_entry_qty
          • ord
          • sprintf
          • get_root_filename
          • get_enum_member_cmt
          • create_word
          • set_func_flags
          • loader_input_t.tell
          • create_align
          • read_dbg_dword
          • next_addr
          • get_bytes
          • batch
          • start_process
          • process_config_line
          • del_user_info
          • qmakefile
          • set_struc_name
          • print_decls
          • create_custom_data
          • del_enum_member
          • format_cdata
          • get_fixup_target_sel
          • get_item_size
          • loader_input_t.gets
          • get_last_bmask
          • Step Tracing Options
          • selector_by_name
          • get_enum_cmt
          • next_not_tail
          • prev_head
          • set_color
          • set_numbered_type
          • get_member_name
          • auto_wait
          • get_enum_member_bmask
          • fseek
          • get_segm_start
          • attach_process
          • Trace file functions
          • get_enum_member_value
          • op_stroff
          • get_next_offset
          • set_processor_type
          • get_bookmark_desc
          • create_data
          • lastattr
          • get_operand_value
          • collect_stack_trace
          • toupper
          • get_fixup_target_dis
          • set_cmt
          • add_entry
          • set_segm_addressing
          • qmake_full_path
          • get_source_linnum
          • fputc
          • resume_thread
          • get_func_attr
          • get_first_enum_member
          • add_sourcefile
          • get_first_bmask
          • read_selection_start
          • hasattr
          • get_member_cmt
          • gen_flow_graph
          • get_array_element
          • get_tinfo
          • loader_input_t
          • tinfo_errstr
          • TRUNC
          • add_segm_ex
          • Local types information and manipulation helpers
          • set_source_linnum
          • get_next_enum_member
          • loader_input_t.readbytes
          • set_array_params
          • jumpto
          • get_bookmark
          • set_enum_bf
          • prev_not_tail
          • toggle_sign
          • loader_input_t.size
          • Trace events functions
          • get_func_flags
          • get_gotea
          • set_segm_attr
          • get_item_head
          • set_default_sreg_value
          • print_insn_mnem
          • set_member_cmt
          • get_ordinal_qty
          • set_target_assembler
          • add_user_stkpnt
          • set_local_type
          • Hidden ranges
          • del_items
          • compile_idc_text
          • Dalvik debugger extension functions
          • byte_value
          • create_dword
          • is_code
          • del_func
          • get_enum
          • make_array
          • rotate_left
          • recalc_spd
          • search_path
          • CommonBits
          • get_processor_name
          • set_func_cmt
          • get_prev_bmask
          • Hashes
          • split_sreg_range
          • process_ui_action
          • set_fixup
          • get_fixup_target_type
          • create_oword
          • get_flags
          • get_func_name
          • create_strlit
          • add_struc
          • atol
          • load_debugger
          • mkdir
          • sizeof
          • get_enum_member_by_name
          • save_database
          • guess_type
          • get_segm_name
          • print_operand
          • qisabspath
          • get_member_qty
          • set_struc_cmt
          • get_fixup_target_flags
          • idadir
          • object.retrieve
          • add_auto_stkpnt
          • get_numbered_type_name
          • get_enum_member_name
          • get_next_index
          • prev_addr
          • get_name_ea
          • get_sp_delta
          • set_bmask_cmt
          • readlong
          • set_segm_name
          • get_prev_offset
          • set_segm_alignment
          • get_strlit_contents
          • forget_exception
          • get_item_end
          • add_func
          • get_name
          • Asks
          • get_spd
          • Debugger: control
          • get_wide_byte
          • plan_and_wait
          • set_enum_flag
          • RunPythonStatement
          • del_sourcefile
          • find_selector
          • get_frame_regs_size
          • op_num
          • define_exception
          • create_double
          • create_byte
          • read_selection_end
          • OpTypes
          • op_plain_offset
          • move_segm
          • get_member_id
          • set_segm_combination
          • get_current_thread
          • trim
          • Debugger: options
          • getn_thread
          • get_frame_id
          • typeinfo.print
          • to_ea
          • rebase_program
          • add_struc_member
          • get_exception_qty
          • get_first_index
          • import_type
          • set_segm_type
          • find_custom_data_type
          • get_next_seg
          • find_func_end
          • get_last_enum_member
          • getattr
          • get_frame_size
          • get_screen_ea
          • loader_input_t.read
          • set_reg_value
          • Debugger: modules
          • create_pack_real
          • writestr
          • exec_idc
          • get_enum_size
          • set_enum_name
          • create_tbyte
          • sel2para
          • atoa
          • loader_input_t.close
          • add_enum
          • ltoa
          • substr
          • del_idc_hotkey
          • Breakpoint handling functions
          • loader_input_t.seek
          • cleanup_appcall
          • object.store
          • get_type
          • qexit
          • get_debug_name
          • get_array_id
          • Can't Open File
          • suspend_process
          • process_config_directive
          • get_entry_name
          • get_last_member
          • get_struc_name
          • clear_selection
          • fclose
          • firstattr
          • create_yword
          • dbg_appcall
          • get_qword
          • patch_dword
          • begin_type_updating
          • read_dbg_byte
          • get_fpnum
          • qsleep
          • get_first_member
          • get_nsec_stamp
          • del_stkpnt
          • eval
          • savefile
          • eval_python
          • Xrefs
          • strstr
          • writeshort
          • get_sreg
          • get_segm_end
          • get_func_off_str
          • set_func_start
          • del_array_element
          • get_full_flags
          • set_exception_flags
          • rename_array
          • get_frame_args_size
          • op_flt
          • get_min_spd_ea
          • apply_type
          • get_prev_index
          • loadfile
          • retrieve_input_file_md5
          • get_wide_dword
          • patch_dbg_byte
          • Functions provided by the WinDbg debugger
          • get_original_byte
          • get_member_strid
          • call_system
          • writelong
          • get_thread_qty
          • nextattr
          • send_dbg_command
          • get_first_seg
          • get_processes
          • patch_word
          • get_manual_insn
          • ftell
          • get_entry_ordinal
          • set_array_long
          • delete_all_segments
          • TO_LONG
          • Function chunk related functions
          • Debugger: events
          • get_prev_func
          • op_seg
          • validate_idb_names
          • fprintf
          • fopen
          • strfill
          • del_fixup
          • get_bmask_name
          • inf_attr
          • is_bf
          • read_dbg_word
          • qdirname
          • get_segm_attr
          • func_contains
          • del_source_linnum
          • get_sourcefile
          • clr_database_flag
          • set_name
          • Refresh Screen
          • op_enum
          • getn_enum
          • get_db_byte
          • setattr
          • get_forced_operand
          • op_bin
          • Functions provided by the replayer debugger
          • prevattr
          • update_extra_cmt
          • get_str_type
          • op_man
          • choose_func
          • set_bmask_name
          • get_curline
          • decode_insn
          • set_segment_bounds
          • set_segm_class
          • write_dbg_memory
          • get_exception_name
          • get_enum_member
          • is_mapped
          • del_enum
          • get_frame_lvar_size
          • get_operand_type
          • set_root_filename
          • compile_idc_file
          • typeinfo.size
          • get_local_tinfo
          • get_fixup_target_off
          • is_union
          • unlink
          • get_segm_by_sel
          • set_enum_width
          • take_memory_snapshot
          • exec_python
          • get_next_func
          • get_member_offset
          • get_func_cmt
          • parse_decl
          • create_qword
          • next_head
          • suspend_thread
          • loader_input_t.getz
          • get_color
          • get_reg_value
          • load_and_run_plugin
          • set_database_flag
          • set_enum_member_name
          • set_member_type
          • get_prev_enum_member
      • IDC examples
        • Analyzing encrypted code
  • Admin Guide
    • Lumina server
    • Teams server
    • License server
      • Hex-Rays License Server Migration Guide
  • Release Notes
    • IDA 9.0
    • IDA 8.4sp2
    • IDA 8.4sp1
    • IDA 8.4
    • IDA 8.3
    • IDA 8.2sp1
    • IDA 8.2
    • IDA 8.1
    • IDA 8.0sp1
    • IDA 8.0
    • IDA 7.7sp1
    • IDA 7.7
    • IDA 7.6sp1
    • IDA 7.6
    • IDA 7.5sp3
    • IDA 7.5sp2
    • IDA 7.5sp1
    • IDA 7.5
    • IDA 7.4sp1
    • IDA 7.4
    • IDA 7.3
      • IDA 7.3 Undo: IDA can do it
    • IDA 7.2
      • IDA 7.2 The Mac Rundown
    • IDA 7.1
      • IDA 7.1 Debugger API 7.1 Porting Guide
    • IDA 7.0sp1
    • IDA 7.0
      • Internationalization (i18n)
      • Automatic discovery of string literals
      • API 7.0 Porting Guide
      • IDAPython backward compatibility
    • IDA 6.95
    • IDA 6.9
    • IDA 6.8
    • IDA 6.7
    • IDA 6.6
    • IDA 6.5
    • IDA 6.4
    • IDA 6.3
    • IDA 6.2
    • IDA 6.1
    • IDA 6.0
    • IDA 5.7
    • IDA 5.6
    • IDA 5.5
      • 5.5 Gallery
      • 5.5 Comparison
    • IDA 5.4
    • IDA 5.3
    • IDA 5.2
    • IDA 5.1
    • IDA 5.0
    • IDA 4.9SP
    • IDA 4.9
    • IDA 4.8
    • IDA 4.7
    • IDA 4.6
    • IDA 4.x
    • IDA 3.x
    • Cumulative bugfix for IDA
  • Archive
    • IDA’s Windbg plugin
    • IDA’s Bochs debugger plugin
    • IDA’s Bochs debugger plugin 2
    • DosWin32
    • Hex-Rays v1.1 vs. v1.0 Decompiler Comparison Page
    • Hex-Rays v1.2 vs. v1.1 Decompiler Comparison Page
    • Hex-Rays v1.3 vs. v1.2 Decompiler Comparison Page
    • Hex-Rays v1.6 vs. v1.5 Decompiler Comparison Page
    • Hex-Rays v1.7 vs. v1.6 Decompiler Comparison Page
    • Costly Greetings – An Adventure In Hostile Code Analysis
    • An Adventure In Hostile Code Analysis: Description
    • An Adventure In Hostile Code Analysis: Disassembly
    • Improved code flow analysis
    • Program Navigation Bar
    • IDA Home Contest
    • Pimp My IDA: vote results
    • Turning off IDA 6.x compatibility in IDAPython
    • Porting guide for IDA 7.4 turning off IDA 6.x API backwards-compatibility by default
    • Porting guide for IDA 7.4 IDAPython and Python 3
    • IDAPython and Python 3
    • Porting guide for changes in IDAPython-on-Python-3 APIs
    • Debugging iOS Applications With IDA
    • IDA Win32 to Win32 Debugging
    • IDA Win32 to Win64 Debugging
    • Legacy license server: Floating Licenses
      • Installing on Linux
      • Installing on Windows
      • Installing on OS X
    • Decompiler Installation
    • Enumerated types tutorial
  • Bug Bounty
Powered by GitBook
LogoLogo

Need Help?

  • FAQs
  • Support

Community

  • Forum
  • Plugins

Resources

  • Blog
  • Download center

© 2025 Copyright Hex-Rays

On this page
  • Introduction
  • Command-line options
  • Commands
  • Operating with metadata
  • Various information
  • Administrative commands
  • Concepts
  • What is the Lumina server
  • Commands
  • String patterns
  • Timerange formats
  • Speed of retrieving changes

Was this helpful?

Export as PDF
  1. User Guide
  2. Lumina

lc command reference manual

Last updated 9 months ago

Was this helpful?

Introduction

The lc executable provides a command-line interface to interact with a Lumina server and its contents.

virtually all the commands described in this document, require administrator rights; "regular" users will typically not have the necessary privileges.

Command-line options

-h, --host HOSTNAME[:PORT] Lumina host name and port (if port is omitted, it defaults to 443)

-u USERNAME specify username

-p PASSWORD specify password

-v, --verbose verbose output

In order to connect to a Lumina server, lc must at least be provided with a hostname and a valid user-password pair.

In order to keep the various commands' syntax as clear as possible, we will omit the login options from commands for the rest of this manual.

Other options exists, specific to each lc command (see ).

Commands

The following commands are accepted by lc:

Operating with metadata

Commands in this section let users view metadata stored in the Lumina server and their history.

hist show

hist show [OPTION]

Queries history of changes for function(s).

The following informations will be displayed for each change:

  • The ID of the change

  • The timestamp of the change

  • The ID of the push that contains the change

  • The name of the function at that change (+ (*) if it has been modified past this change)

  • optional: The username of the user that pushed this change

  • optional: The name of the license associated with the push for this change

  • optional: The email of the license associated with the push for this change

  • optional: The ID of the license associated with the push for this change

  • optional: The ID of the function

  • optional: The effective address (EA) of the function in the input file for the change

  • optional: The hash of the function

  • optional: The path of the idb file where the change came from

  • optional: The hash of the file where the change came from

  • optional: The path of the file where the change came from

-a, --additional-fields LIST Comma-delimited list of additional info to display (username, license_name, license_email, license_id, func_id, func_ea, calcrel_hash, idb_path, input_hash, input_path, all)

-d, --details Show details (diff-like) for each change

--chronological Display entries in chronological order (defaults to reverse-chronological).

-m, --max-entries NUMBER maximum number of entries to fetch (defaults to 100)

-l, --license-id LICENSE license ID (XX-XXXX-XXXX-XX format) to operate on

-r, --history-id-range RANGE history ID range(s) to operate on (start0..end0 […​])

-i, --idb IDB IDB name(s) to operate on

-f, --input FILE input file(s) to operate on

-u, --username USERNAME username(s) to operate on

-n, --func NAME function name(s) to operate on

-h, --input-hash HASH input file hash(es) to operate on

-p, --pushes-id-range RANGE Pushes ID range(s) to operate on (start0..end0 […​])

-c, --calcrel-hash HASH function hash(es) to operate on

Examples:

List the last 8 changes ("-m 8" specifies the number of changes to show; the default order is reverse-chronological)

alice@alice_PC$ lc hist show -m 8
    Change Time                Push Func name
    ------ ------------------- ---- ---------------------------
    507    2022-09-15 14:48:18 5    math_things
    506    2022-09-15 14:48:17 4    calc_things (*)
    505    2022-09-15 14:48:17 4    start
    504    2022-09-15 14:48:16 3    keygen_window_dialog_proc_a
    503    2022-09-15 14:48:16 3    display_keygen_window
    502    2022-09-15 14:48:15 2    fstat
    501    2022-09-15 14:48:15 2    __umoddi3
    500    2022-09-15 14:48:15 2    __udivdi3
    # Shown 8 results (more are available...)

List changes from id 9 up to (but excluding) id 14

alice@alice_PC$ lc hist show -r9..14
    Change Time                Push Func name
    ------ ------------------- ---- ---------------------
    13     2022-09-15 14:48:05 2    AllocateBucketGroup
    12     2022-09-15 14:48:05 2    addr_map_find
    11     2022-09-15 14:48:05 2    addr_map_insert
    10     2022-09-15 14:48:05 2    addr_map_compare_func
    9      2022-09-15 14:48:05 2    addr_map_free_func
    # Shown 5 results

List changes using multiple ranges (9..14,505..515; in this case, there were no changes after 507 in the database)

alice@alice_PC$ lc hist show -r9..14,505..515
    Change Time                Push Func name
    ------ ------------------- ---- ---------------------
    507    2022-09-15 14:48:18 5    math_things
    506    2022-09-15 14:48:17 4    calc_things (*)
    505    2022-09-15 14:48:17 4    start
    13     2022-09-15 14:48:05 2    AllocateBucketGroup
    12     2022-09-15 14:48:05 2    addr_map_find
    11     2022-09-15 14:48:05 2    addr_map_insert
    10     2022-09-15 14:48:05 2    addr_map_compare_func
    9      2022-09-15 14:48:05 2    addr_map_free_func
    # Shown 8 results

Find changes from a specific idb file ("-i"), showing the function hash and ea ("-a" adds additional columns to the output)

alice@alice_PC$ lc hist show -i C:\malware\apts\pc_keygenme_3.pe.idb -a calcrel_hash,func_ea
    Change Time                Push Func name                   Func EA Func hash
    ------ ------------------- ---- --------------------------- ------- --------------------------------
    504    2022-09-15 14:48:16 3    keygen_window_dialog_proc_a 4011e2  420A0485EDB7C6774E1822953FB785D4
    503    2022-09-15 14:48:16 3    display_keygen_window       401099  ACA673D198FBC0DF24C20A15FF7F25CE
    # Shown 2 results

Show the first 4 changes ("-m4") with their input file(s) (in "--chronological" order; "-a" adds an additional column)

alice@alice_PC$ lc hist show --chronological -m 4 -a input_path
    Change Time                Push Func name             Input path
    ------ ------------------- ---- --------------------- ------------------------------------
    1      2022-09-15 14:47:44 1    .init_proc            /home/alice/work/pc_dwarf_arrays.elf
    2      2022-09-15 14:47:44 1    _start                /home/alice/work/pc_dwarf_arrays.elf
    3      2022-09-15 14:47:44 1    __do_global_dtors_aux /home/alice/work/pc_dwarf_arrays.elf
    4      2022-09-15 14:47:44 1    frame_dummy           /home/alice/work/pc_dwarf_arrays.elf
    # Shown 4 results (more are available...)

Show the last change by a user ("-u" indicates the user, "-m1" means show 1 change only, "-a" adds an additional column)

alice@alice_PC$ lc hist show -ubob -m1 -a username
    Change Time                Push Func name Username
    ------ ------------------- ---- --------- --------
    502    2022-09-15 14:48:15 2    fstat     bob
    # Shown 1 results (more are available...)

Show up to 4 changes ("-m4") between two dates ("-t" indicates a range of "YYYY-MM-DD" dates)

alice@alice_PC$ lc hist show -m4 -t2022-09-02..2022-12-03
    Change Time                Push Func name
    ------ ------------------- ---- ---------------------------
    507    2022-09-15 14:48:18 5    math_things
    506    2022-09-15 14:48:17 4    calc_things (*)
    505    2022-09-15 14:48:17 4    start
    504    2022-09-15 14:48:16 3    keygen_window_dialog_proc_a
    # Shown 4 results (more are available...)

Show up to 4 changes ("-m4") between two "now"-relative dates ("-t", from 2 weeks ago to 5 minutes ago) ("-a" adds an additional column)

alice@alice_PC$ lc hist show -m4 -t-2w..-5M -a func_id
    Change Time                Push Func name                   Func ID
    ------ ------------------- ---- --------------------------- -------
    507    2022-09-15 14:48:18 5    math_things                 506
    506    2022-09-15 14:48:17 4    calc_things (*)             506
    505    2022-09-15 14:48:17 4    start                       505
    504    2022-09-15 14:48:16 3    keygen_window_dialog_proc_a 504
    # Shown 4 results (more are available...)

Show up to 4 changes ("-m4") between two "now"-relative dates ("-t", from 2 weeks ago to 5 minutes ago) ("-a" adds an additional column), only select the last change for each function

alice@alice_PC$ lc hist show -m4 -t-2w..-5M -a func_id --last-change
    Change Time                Push Func name                   Func ID
    ------ ------------------- ---- --------------------------- -------
    507    2022-09-15 14:48:18 5    math_things                 506
    505    2022-09-15 14:48:17 4    start                       505
    504    2022-09-15 14:48:16 3    keygen_window_dialog_proc_a 504
    503    2022-09-15 14:48:16 3    display_keygen_window       503
    # Shown 4 results (more are available...)

Show up to 4 changes ("-m4"), occurring after a "now"-relative date ("-t", from 6 hours ago up to now)

alice@alice_PC$ lc hist show -m4 -t-6H
    Change Time                Push Func name
    ------ ------------------- ---- ---------------------------
    507    2022-09-15 14:48:18 5    math_things
    506    2022-09-15 14:48:17 4    calc_things (*)
    505    2022-09-15 14:48:17 4    start
    504    2022-09-15 14:48:16 3    keygen_window_dialog_proc_a
    # Shown 4 results (more are available...)

Show changes about a specific function name ("-n")

alice@alice_PC$ lc hist show -n print_relocinfo
    Change Time                Push Func name
    ------ ------------------- ---- ---------------
    175    2022-09-15 14:48:08 2    print_relocinfo
    # Shown 1 results

Show changes about a function name ("-n") searched by wildcard ("like:…​")

alice@alice_PC$ lc hist show -n "like:%reloc%info%"
    Change Time                Push Func name
    ------ ------------------- ---- --------------------------
    179    2022-09-15 14:48:08 2    print_reloc_information_32
    178    2022-09-15 14:48:08 2    print_reloc_information_64
    177    2022-09-15 14:48:08 2    print_relocinfo_32
    176    2022-09-15 14:48:08 2    print_relocinfo_64
    175    2022-09-15 14:48:08 2    print_relocinfo
    # Shown 5 results

Show metadata details ("--details") in changes for a function ("-n"); this particular change added a new function

alice@alice_PC$ lc hist show -n is_location_form --details
    Change Time                Push Func name
    ------ ------------------- ---- ----------------
    126    2022-09-15 14:48:07 2    is_location_form
          >> Score
          >>     - 0
          >>     + 1445
          >> Name
          >>     - None
          >>     + is_location_form
          >> Prototype
          >>     -
          >>     + 0C303D08626F6F6C65616E0207
          >> Member @ 0x8
          >>     .type
          >>         - None
          >>         + 07
          >>     .cmt
          >>         - None
          >>         +
          >>     .rptcmt
          >>         - None
          >>         +
          >> Insn operands @ 0+0x3
          >>     - [<no ops repr>]
          >>     + [op0=0xb, op1=0x0, op2=0x0, op3=0x0, op4=0x0, op5=0x0, op6=0x0, op7=0x0]
          >> Insn operands @ 0+0x9
          >>     - [<no ops repr>]
          >>     + [op0=0xb, op1=0x0, op2=0x0, op3=0x0, op4=0x0, op5=0x0, op6=0x0, op7=0x0]
          >> Insn operands @ 0+0xf
          >>     - [<no ops repr>]
          >>     + [op0=0xb, op1=0x0, op2=0x0, op3=0x0, op4=0x0, op5=0x0, op6=0x0, op7=0x0]
          >> Insn operands @ 0+0x15
          >>     - [<no ops repr>]
          >>     + [op0=0xb, op1=0x0, op2=0x0, op3=0x0, op4=0x0, op5=0x0, op6=0x0, op7=0x0]
          >> Insn operands @ 0+0x1b
          >>     - [<no ops repr>]
          >>     + [op0=0xb, op1=0x0, op2=0x0, op3=0x0, op4=0x0, op5=0x0, op6=0x0, op7=0x0]
          >> Insn operands @ 0+0x21
          >>     - [<no ops repr>]
          >>     + [op0=0xb, op1=0x0, op2=0x0, op3=0x0, op4=0x0, op5=0x0, op6=0x0, op7=0x0]
          >> Insn operands @ 0+0x27
          >>     - [<no ops repr>]
          >>     + [op0=0xb, op1=0x0, op2=0x0, op3=0x0, op4=0x0, op5=0x0, op6=0x0, op7=0x0]
    # Shown 1 results

hist pushes

hist pushes [OPTION]

Shows pushes to the Lumina server.

-a, --additional-fields LIST Comma-delimited list of additional info to display (license_name, license_email, license_id, all)

-t, --time-range TIMESTAMP timestamp

-u, --username USERNAME username(s) to operate on

-l, --license-id LICENSE license ID (XX-XXXX-XXXX-XX format) to operate on

-m, --max-entries NUMBER maximum number of entries to operate on (defaults to 100)

--chronological Display entries in chronological order (defaults to reverse-chronological).

Examples:

alice@alice_PC$ lc hist pushes
    Push ID Time                User name IDB path
    ------- ------------------- --------- ----------------------------------------
    5       2022-09-15 14:48:18 alice     /home/alice/work/pc_math_b_64.elf.i64
    4       2022-09-15 14:48:17 alice     /home/alice/work/pc_math_a_64.elf.i64
    3       2022-09-15 14:48:16 damian    C:\malware\apts\pc_keygenme_3.pe.idb
    2       2022-09-15 14:48:05 bob       /Users/bob/idbs/pc_dwarfdump.elf.idb
    1       2022-09-15 14:47:44 alice     /home/alice/work/pc_dwarf_arrays.elf.idb
    # Shown 5 results

List all pushes from a specific license ID

alice@alice_PC$ lc hist pushes -l BB-0B0B-AC8E-01 -a license_email
    Push ID Time                User name License email IDB path
    ------- ------------------- --------- ------------- ------------------------------------
    2       2022-09-15 14:48:05 bob       bob@acme.com  /Users/bob/idbs/pc_dwarfdump.elf.idb
    # Shown 1 results

List all pushes from licenses with IDs matching a pattern ("-a" adds an additional column)

alice@alice_PC$ lc hist pushes -l like:AA-% -a license_id
    Push ID Time                User name License ID      IDB path
    ------- ------------------- --------- --------------- ----------------------------------------
    5       2022-09-15 14:48:18 alice     AA-A11C-AC8E-01 /home/alice/work/pc_math_b_64.elf.i64
    4       2022-09-15 14:48:17 alice     AA-A11C-AC8E-01 /home/alice/work/pc_math_a_64.elf.i64
    1       2022-09-15 14:47:44 alice     AA-A11C-AC8E-01 /home/alice/work/pc_dwarf_arrays.elf.idb
    # Shown 3 results

Show the first push

alice@alice_PC$ lc hist pushes --chronological -m 1
    Push ID Time                User name IDB path
    ------- ------------------- --------- ----------------------------------------
    1       2022-09-15 14:47:44 alice     /home/alice/work/pc_dwarf_arrays.elf.idb
    # Shown 1 results (more are available...)

List all pushes between two timestamps

alice@alice_PC$ lc hist pushes -t"2022-09-07 10:20:00..2022-12-31"
    Push ID Time                User name IDB path
    ------- ------------------- --------- ----------------------------------------
    5       2022-09-15 14:48:18 alice     /home/alice/work/pc_math_b_64.elf.i64
    4       2022-09-15 14:48:17 alice     /home/alice/work/pc_math_a_64.elf.i64
    3       2022-09-15 14:48:16 damian    C:\malware\apts\pc_keygenme_3.pe.idb
    2       2022-09-15 14:48:05 bob       /Users/bob/idbs/pc_dwarfdump.elf.idb
    1       2022-09-15 14:47:44 alice     /home/alice/work/pc_dwarf_arrays.elf.idb
    # Shown 5 results

List all pushes from two users ("-a" adds an additional column)

alice@alice_PC$ lc hist pushes -u"bob damian" -a"license_name license_id"
    Push ID Time                User name License name License ID      IDB path
    ------- ------------------- --------- ------------ --------------- ------------------------------------
    3       2022-09-15 14:48:16 damian    Damian       DD-DA81-A000-01 C:\malware\apts\pc_keygenme_3.pe.idb
    2       2022-09-15 14:48:05 bob       Bob          BB-0B0B-AC8E-01 /Users/bob/idbs/pc_dwarfdump.elf.idb
    # Shown 2 results

hist del

hist del [OPTION]

Deletes history and metadata for functions.

-s, --silent Do not ask for confirmation before deleting history

-l, --license-id LICENSE license ID (XX-XXXX-XXXX-XX format) to operate on

-r, --history-id-range RANGE history ID range(s) to operate on (start0..end0 […​])

-i, --idb IDB IDB name(s) to operate on

-f, --input FILE input file(s) to operate on

-u, --username USERNAME username(s) to operate on

-n, --func NAME function name(s) to operate on

-h, --input-hash HASH input file hash(es) to operate on

-p, --pushes-id-range RANGE Pushes ID range(s) to operate on (start0..end0 […​])

-c, --calcrel-hash HASH function hash(es) to operate on

Examples:

Display the last 10 changes, with their input file(s) and function ID(s)

alice@alice_PC$ show -m10 -a input_path
    Change Time                Push Func name                   Func ID Input path
    ------ ------------------- ---- --------------------------- ------- ---------------------------------
    507    2022-09-15 14:48:18 5    math_things                 506     /home/alice/work/pc_math_b_64.elf
    506    2022-09-15 14:48:17 4    calc_things (*)             506     /home/alice/work/pc_math_a_64.elf
    505    2022-09-15 14:48:17 4    start                       505     /home/alice/work/pc_math_a_64.elf
    504    2022-09-15 14:48:16 3    keygen_window_dialog_proc_a 504     C:\malware\apts\pc_keygenme_3.pe
    503    2022-09-15 14:48:16 3    display_keygen_window       503     C:\malware\apts\pc_keygenme_3.pe
    502    2022-09-15 14:48:15 2    fstat                       502     /Users/bob/idbs/pc_dwarfdump.elf
    501    2022-09-15 14:48:15 2    __umoddi3                   501     /Users/bob/idbs/pc_dwarfdump.elf
    500    2022-09-15 14:48:15 2    __udivdi3                   500     /Users/bob/idbs/pc_dwarfdump.elf
    499    2022-09-15 14:48:14 2    dwarf_get_ADDR_name         499     /Users/bob/idbs/pc_dwarfdump.elf
    498    2022-09-15 14:48:14 2    dwarf_get_FRAME_name        498     /Users/bob/idbs/pc_dwarfdump.elf
    # Shown 10 results (more are available...)

Delete all changes for functions matching a pattern

alice@alice_PC$ lc hist del -s -n like:%dwarf%
    267 entries deleted from history

alice@alice_PC$ hist show -m10 -a input_path,func_id
    Change Time                Push Func name                   Func ID Input path
    ------ ------------------- ---- --------------------------- ------- ---------------------------------
    507    2022-09-15 14:48:18 5    math_things                 506     /home/alice/work/pc_math_b_64.elf
    506    2022-09-15 14:48:17 4    calc_things (*)             506     /home/alice/work/pc_math_a_64.elf
    505    2022-09-15 14:48:17 4    start                       505     /home/alice/work/pc_math_a_64.elf
    504    2022-09-15 14:48:16 3    keygen_window_dialog_proc_a 504     C:\malware\apts\pc_keygenme_3.pe
    503    2022-09-15 14:48:16 3    display_keygen_window       503     C:\malware\apts\pc_keygenme_3.pe
    502    2022-09-15 14:48:15 2    fstat                       502     /Users/bob/idbs/pc_dwarfdump.elf
    501    2022-09-15 14:48:15 2    __umoddi3                   501     /Users/bob/idbs/pc_dwarfdump.elf
    500    2022-09-15 14:48:15 2    __udivdi3                   500     /Users/bob/idbs/pc_dwarfdump.elf
    474    2022-09-15 14:48:14 2    free_macro_stack            474     /Users/bob/idbs/pc_dwarfdump.elf
    468    2022-09-15 14:48:14 2    print_line_detail           468     /Users/bob/idbs/pc_dwarfdump.elf
    # Shown 10 results (more are available...)

Delete all changes stemming from a specific file

alice@alice_PC$ lc hist del -s -f/Users/bob/idbs/pc_dwarfdump.elf
    228 entries deleted from history

List the changes from pushes 1 to 5 (not included), showing their input file(s)

alice@alice_PC$ lc show -p1..5 -a input_path
    Change Time                Push Func name                   Input path
    ------ ------------------- ---- --------------------------- ------------------------------------
    506    2022-09-15 14:48:17 4    math_things                 /home/alice/work/pc_math_a_64.elf
    505    2022-09-15 14:48:17 4    start                       /home/alice/work/pc_math_a_64.elf
    504    2022-09-15 14:48:16 3    keygen_window_dialog_proc_a C:\malware\apts\pc_keygenme_3.pe
    503    2022-09-15 14:48:16 3    display_keygen_window       C:\malware\apts\pc_keygenme_3.pe
    7      2022-09-15 14:47:44 1    __do_global_ctors_aux       /home/alice/work/pc_dwarf_arrays.elf
    6      2022-09-15 14:47:44 1    __libc_csu_init             /home/alice/work/pc_dwarf_arrays.elf
    5      2022-09-15 14:47:44 1    main                        /home/alice/work/pc_dwarf_arrays.elf
    4      2022-09-15 14:47:44 1    frame_dummy                 /home/alice/work/pc_dwarf_arrays.elf
    3      2022-09-15 14:47:44 1    __do_global_dtors_aux       /home/alice/work/pc_dwarf_arrays.elf
    2      2022-09-15 14:47:44 1    _start                      /home/alice/work/pc_dwarf_arrays.elf
    1      2022-09-15 14:47:44 1    .init_proc                  /home/alice/work/pc_dwarf_arrays.elf
    # Shown 11 results

Delete one single change

alice@alice_PC$ lc hist del -s -r505..506
    1 entries deleted from history

Delete all the changes from push 1

alice@alice_PC$ lc hist del -s -p 1..2
    7 entries deleted from history

alice@alice_PC$ hist show -a username
    Change Time                Push Func name                   Username
    ------ ------------------- ---- --------------------------- --------
    507    2022-09-15 14:48:18 5    math_things                 alice
    506    2022-09-15 14:48:17 4    calc_things (*)             alice
    504    2022-09-15 14:48:16 3    keygen_window_dialog_proc_a damian
    503    2022-09-15 14:48:16 3    display_keygen_window       damian
    # Shown 4 results

Delete all changes by a user

alice@alice_PC$ lc hist del -s -udamian
    2 entries deleted from history

alice@alice_PC$ hist show -a func_id
    Change Time                Push Func name       Func ID
    ------ ------------------- ---- --------------- -------
    507    2022-09-15 14:48:18 5    math_things     506
    506    2022-09-15 14:48:17 4    calc_things (*) 506
    # Shown 2 results

Delete the last change for a function

alice@alice_PC$ lc hist del -s --func math_things --last-change
    1 entries deleted from history

alice@alice_PC$ hist show -a func_id
    Change Time                Push Func name   Func ID
    ------ ------------------- ---- ----------- -------
    506    2022-09-15 14:48:17 4    calc_things 506
    # Shown 1 results

Delete all remaining changes for a function by name

alice@alice_PC$ lc hist del -s --func calc_things
    1 entries deleted from history

alice@alice_PC$ hist show
    # Shown 0 results

Various information

info

info

Shows lumina connection information.

Example:

alice@alice_PC$ lc info
Hex-Rays Lumina Server v8.0
Lumina time: 2022-08-29 10:13:37, up since 2022-08-21 21:00:05
MAC address: FF:32:67:FF:D3:00
Client name: alice *ADMIN*
Client host: 127.0.0.1

users

users

Shows users.

Example:

alice@alice_PC$ lc users
LastActive Adm Login  License         User name                   Email
---------- --- ------ --------------- --------------------------- ------------------
2022-08-29 *   bob    XX-XXXX-XXXX-XX bob                         bob@acme.com
2022-08-29 *   alice  XX-XXXX-XXXX-XX alice                       alice@acme.com
2022-08-27     damian XX-XXXX-XXXX-XX damian                      damian@acme.com

stats

stats [OPTION]

Shows the numbers of functions, pushes, history records, IDBs and input files stored in the Lumina server database.

-u, --username USERNAME username(s) to operate on

Examples:

alice@alice_PC$ lc stats
    Consolidated statistics from lumina_server:
    Number of functions: 4
    Number of pushes: 5
    Number of history records: 6
    Number of IDBs: 3
    Number of input files: 3
    ---------------------------------------------

Retrieve the statistics for a list of users

alice@alice_PC$ lc stats -ualice,bob,russ
    Statistics for alice:
    Number of functions: 2
    Number of pushes: 3
    Number of history records: 4
    Number of IDBs: 1
    Number of input files: 1
    ---------------------------------------------
    Statistics for bob:
    Number of functions: 1
    Number of pushes: 1
    Number of history records: 1
    Number of IDBs: 1
    Number of input files: 1
    ---------------------------------------------

Administrative commands

These commands require that the user executing them has admin privileges.

Managing users

The following commands allow the administrator to manipulate users known to the Lumina server.

user add

user add USERNAME EMAIL IS_ADMIN LICENSE_ID

Adds a user.

Thecommand must be used after creating a user; otherwise the new user will not be able to login to the Lumina server and use it.

USERNAME

The username of the user.

EMAIL

The email address of the user.

IS_ADMIN

Should be 1 if the user is admin, otherwise 0.

LICENSE_ID

The license of the user.

Parameters

Example:

alice@alice_PC$ lc user add damiank damian@acme.com 0 XX-XXXX-XXXX-XX

user edit

user edit USERNAME EMAIL IS_ADMIN LICENSE_ID

Edits a user definition.

USERNAME

The username of the user to modify.

EMAIL

The email address of the user.

IS_ADMIN

Should be 1 if the user is admin, otherwise 0.

LICENSE_ID

The license of the user.

Parameters

Example:

For the given username, set the email, admin flag and license ID

alice@alice_PC$ lc user edit damiank damiank@acme.com 0 XX-XXXX-XXXX-XX

user del

user del USERNAME EMAIL LICENSE_ID

Deletes a user.

USERNAME

The name of the user to delete.

EMAIL

The email address of the user.

LICENSE_ID

The license of the user.

Parameters

Example:

alice@alice_PC$ lc user del damiank damiank@acme.com XX-XXXX-XXXX-XX

passwd

passwd PASS USER

Modifies the password for a user.

PASS

The new password.

USER

The username whose password should be changed Only admins can change other users' passwords.

Parameters

Example:

alice@alice_PC$ lc passwd secret_password john

The host name (and port) of the Hex-Rays Vault server need to be present in the lumina.conf file.

Managing sessions

session list

session list

Lists the current connections to the Lumina server. For each connection, the currently executed query (if any) is shown.

Example:

alice@alice_PC$ lc session list
id=1642 peer="127.0.0.1", user="...", license="...", e-mail="...", established="2022-08-16 17:13:21"
current_query="INSERT INTO pushes (fk_idb, fk_user) VALUES (?, ?)" (0msec)

session kill

session kill ID

Kills an existing connection to the Lumina server.

ID

The connection to kill, as shown by thecommand

Parameters

Example:

alice@alice_PC$ lc session list
id=1 peer="127.0.0.1", user="...", license="...", e-mail="...", established="2022-09-20 16:47:07" current_query="" (0msec)
alice@alice_PC$ lc session kill 1
Connection killed
alice@alice_PC$ lc session list
No connections.

Concepts

What is the Lumina server

The Lumina server is a "functions metadata" repository.

It is a place where IDA users can push, and pull such metadata, to ease their reverse-engineering work: metadata can be extracted from existing projects, and re-applied effortlessly to new projects, thereby reducing (sometimes dramatically) the amount of time needed to analyze binaries.

Functions metadata

The Lumina server associates "function metadata" to functions, by means of a (md5) hash of those functions: whenever it wants to push information to, or pull information from the server, IDA will first have to compute hashes of the functions it wants to retrieve metadata for, and send those hashes to the Lumina server.

Similarly, when IDA pushes information to the Lumina server, it will first compute hashes for the corresponding functions, extract the metadata corresponding to those from the .idb file, and send those hash+metadata pairs to the server.

Metadata contents

Metadata about functions can include:

  • function name

  • function address

  • function size

  • function prototype

  • function [repeatable] comments

  • instruction-specific [repeatable] comments

  • anterior/posterior (i.e., "extra") comments

  • user-defined "stack points" in the function’s frame

  • the function frame description and stack variables

  • instructions operands representations

Pushing & overriding metadata

When a user pushes metadata about a function whose md5 hash isn’t present in the database, the Lumina server will simply create a new record for it.

However, when a user pushes metadata about a function whose md5 hash (and associated metadata) is already present in the database, the Lumina server will attempt to "score" the quality of the old metadata and the quality of the new metadata. If the score of the new metadata is higher, the new function metadata will override the previous one.

When a user asks IDA to push all functions to the Lumina server, IDA will automatically skip some functions: those that still have a "dummy" name (e.g., sub_XXXX), or that are below a certain size threshold (i.e., 32 bytes) will be ignored.

Metadata history

The Lumina server retains a history of the metadata associated to functions. Using the lc utility, it is possible to dig into that history, and view changes (detailed diffs, too.)

File contents

It’s worth pointing out that when pushing metadata to the Lumina server, IDA will not push the binary file itself. Only the following metadata about the file itself will be sent:

  • the name of the input file

  • the name of the IDB file

  • a md5 hash of the input file

The Lumina server cannot therefore be used as a backup/repository for binary files & IDBs

Commands

String patterns

Options that take strings as inputs can be enhanced through wildcards. The following wildcards are available:

% represents zero, one or multiple characters.

_ represents one character.

To use wildcards in a string, it must be prefixed with like: e.g. -n like:%main%.

Timerange formats

For timeranges, the following syntaxes are supported:

  • <ts>..<ts> (from timestamp to (but not including) timestamp)

  • <ts> (only one timestamp)

Where <ts> can be of the form:

  • yyyy-mm-dd HH:MM:SS: e.g., 2022-09-12 11:38:22

  • yyyy-mm-dd: e.g., 2020-03-12

  • +|-<count><unit>: this is a "now-relative" timestamp, where <unit> must be one of w, d, H, M, S for weeks, days, hours, minutes or seconds respectively. E.g., -4d, +5w, -8H, +1H, …​

when using the <ts> syntax (i.e., only 1 timestamp is provided, not an actual range), the final range will be either "from now to <ts>", or "from <ts> to now", depending on whether <ts> is before, or after, the present time.

Speed of retrieving changes

Although it may seem like a simple operation, lc hist show is actually a very demanding one: by default it will have to fetch bits of information from multiple tables (e.g., in order to provide information about which change was superseded by a later one.)

This can be significantly sped up through the use of --last-change: this option lets the server issue a much simpler query, resulting in significantly reduced processing time.

Wildcards can be used to facilitate the usage of options that take strings as input. See the .

-t, --time-range RANGE time range to operate on (start..end) see the

--last-change Select only the last change for a function (which )

-t, --time-range RANGE time range to operate on (start..end) see the

--last-change Select only the last change for a function (which )

Commands
appendix
appendix
speeds up execution
appendix
speeds up execution