With IDA 9.0, we changed how the Hex-Rays documentation is organized and added new guides and tutorials to kickstart your IDA journey and ease the migration from previous IDA versions.

New Structure

Our docs are divided into three main categories:

• User Guide, dedicated to individual users and covering whole IDA products (including add-ons, like Teams and Lumina). Most of the documentation regarding IDA, like manuals or tutorials, is currently accessible under the User Guide.

• Developer Guide, which focuses on developer's needs, covers the reference and contextual documentation for IDAPython API and C++ SDK, as well as native IDC language. This part is mainly dedicated to plugin authors and devs interested in enhancing basic IDA capabilities with our development kit or scripting.

• Admin Guide mainly focuses on administrators installing and managing servers for Teams and Lumina or floating licenses.

In Archive, we gathered docs with rather historical value that some of you may still find interesting but focused on previous versions of IDA.

New Getting Started Guides

We prepared a Getting Started section for IDA newbies and also gathered additional materials to help you find your way around our IDAPython API or IDA SDK.

Migration and Porting Guides

For those familiar with previous versions of IDA, we prepared Porting Guides for IDAPython and C++ SDK. If you use the Flexera server for floating licenses, check our Migration Guide for new Hex-Rays license server.

First experience with IDA? Great, you are in the right place. Here you can find guides designed to quickly onboard you into IDA. We will walk you through license activation and IDA installation to the essential tasks you can perform in IDA.

By following the steps in this guide, you can successfully install your IDA instance on macOS, Linux, and Windows.

The installation steps are valid for all product versions: IDA Pro, IDA Home, or IDA Free (except license registration).

This installation guide is dedicated to individual users.

Minimum system requirements

Pre-installation steps

Installation on macOS

Prerequisites:

• Make sure Python 3 or later is installed on your computer for the IDAPython API to function properly.

Step 1: Download the installer

Step 2: Run the installer

• Extract the .zip archive.

• Double-click on the extracted file to run the instalation wizard.

• Follow the wizard's instructions to complete the installation:

  • accept the license agreement and installation directory;

  • copy your ida.hexlic file to IDA installation directory or to $HOME/.idapro directory before launching IDA.

Step 4: Launch IDA Pro for the first time

• Double-click on the IDA Pro icon to launch the application.

Step 5: Point to your named/computer license

• In the License manager pop-up window, specify the path of your license file and click OK.

Installation on Linux

Prerequisites:

• Make sure Python 3 or later is installed on your computer for the IDAPython API to function properly.

• Verify that you have the required libraries installed. Use your package manager to install any missing dependencies. Common dependencies include libx11, libxext, libxrender, and libglib2.0.

Step 1: Download the installer

Step 4: Run the installer

• Navigate to the directory containing your IDA installer, and make it executable.

• Run the installer by double-click it or enter ./<your_IDA_version_>linux.run in the terminal to execute it.

• Follow the wizard's instructions to complete the installation:

  • accept the license agreement and installation directory;

  • copy your ida.hexlic file to IDA installation directory or to $HOME/.idapro directory before launching IDA.

Step 5: Launch IDA Pro for the first time

• Go to the directory where IDA is installad and run the command: ./ida90

Step 6: Point to your named/computer license

• In the License manager pop-up window, specify the path of your license file and click OK.

Installation on Windows

• Make sure Python 3 or later is installed on your computer for the IDAPython API to function properly.

Step 1: Download the installer

Step 2: Run the installer

• Locate the downloaded .exe file and double-click it to run the installer.

• Follow the installation wizard's instructions to complete the installation:

  • accept the license agreement and installation directory;

  • copy your ida.hexlic file to IDA installation directory or to %APPDATA%/Hex-Rays/IDA Pro directory before launching IDA.

Step 5: Launch IDA Pro for the first time

• Navigate to the Start Menu or desktop shortcut and launch IDA Pro.

Step 6: Point to your named/computer license

• In the License Manager pop-up window, specify the path of your license file and click OK.

Use floating license server

Step 1: In the License manager pop-up window, select the option Use floating license server and then type a license server hostname provided by your administrator.

Step 2: Borrow one of the licenses visible under the available licenses list and click OK.

Note that you don't need a license file stored on your machine locally while using floating licenses.

Common Post-Installation Steps

Step 1: Update IDA Pro

• After installation, check for any available updates. Hex-Rays often releases patches and updates for IDA Pro. You can check for updates within the application via Help -> Check for free update or download the latest version from My Hex-Rays portal.

Step 2: Configure environment (optional)

Step 3: Install additional plugins (optional)

• You can extend the functionality of IDA Pro by installing additional plugins that can be found on the official Hex-Rays website or other trusted sources in the reverse engineering community.

In this document, we covered the basics regarding our licensing model: you can check how to activate your license depending on the license type, what to do with the downloaded license files, and how to finalize license settings while running IDA. This guide is dedicated to individual users.

Licenses overview

License types

In Hex-Rays, we offer two basic license types for IDA products, that are suitable for individual users:

• Named licenses, that are assigned to specific individuals.

• Computer licenses that are assigned to specific devices.

There is also an additional type, called floating licenses, that allow a set number of concurrent users but are not assigned to specific individuals or devices.

What are license files, and where can I find them?

The license file contains your license ID and other data and is required to make your IDA instance fully operative after installation.

You can download your license file from My Hex-Rays portal, after its activation.

License Activation

To complete the installation, you need an active IDA license with an assigned owner or a MAC address. Without activation, you cannot download your license file.

What is needed to assign my license?

• for named licenses: the email address of the owner,

• for computer licenses: the MAC address of a specific device

• for floating licenses: the MAC address of the device where the license server will be running

Named licenses activation

1. Navigate to Licenses -> Subscriptions. On the list, find the license ID and product for which you want to activate the license. Under Actions column, click on the three dots, and then in the dropdown menu, click Activate license.

1. In the new dialog, assign the ownership of the license: set the email address for this IDA instance user (it can be yours) and select decompilers. Optionally, select a Lumina and Teams server and tick the checkbox to send your license via email.

1. Click Assign button and then Click to confirm to finalize the assignment.

2. In the main subscriptions view, click on the three dots under Actions column, and in the dropdown menu, click Download license key to save it locally. You will need it to complete the installation process.

1. Navigate to the Download center on the left-side menu, locate your IDA product and base on your operating system, select an installer to download.

What's next?

Computer licenses activation

1. Navigate to Licenses -> Subscriptions. On the list, find the license ID and product for which you want to activate the license. Under Actions column, click on the three dots, and then in the dropdown menu, click Activate license.

1. In the new dialog, assign the ownership of the license: set the MAC address of the machine where this IDA instance will be installed and running (it can be yours) and select decompilers. Optionally, select a Lumina and Teams server and tick the checkbox to send your license via email.

1. Click Assign button and then Click to confirm to finalize the assignment.

2. In the main subscriptions view, click on the three dots under Actions column, and in the dropdown menu, click Download license key to save it locally. You will need it to complete the installation process.

1. Navigate to the Download center on the left-side menu, locate your IDA product and base on your operating system, select an installer to download.

What's next?

Server licenses for businesses and organizations

In this part, we cover the basics of license activation for floating license servers, Teams and Private Lumina servers, and the floating license server.

The server installers and license files are available via My Hex-Rays portal.

License server licenses

Floating licenses are managed by administrators and require a license server to work. If you purchase the floating licenses, you will see an additional license for the license server in your Hex-Rays portal.

License server activation for admins

Similar to named and computer licenses, license server licenses need to be activated in the My Hex-Rays portal.

2. Navigate to Licenses -> Subscriptions. On the list, find the license server ID for which you want to activate the license. Under Actions column, click on the three dots, and then in the dropdown menu, click Activate license.

3. In the new dialog, assign the ownership to the license server and provide the MAC address of the device where the license server will be running.

4. Click Assign button and then Click to confirm to finalize the assignment.

5. In the main subscriptions view, click on the three dots under Actions column, and in the dropdown menu, click Download license key to save it locally. You will need it to complete the installation process.

6. Navigate to the Download center on the left-side menu, and select a license server installer to download.

License server installation for admins

How can I start using IDA as a floating license user?

You don't need to download a license file/key to your local machine while using the floating licenses server.

Floating licenses borrowing

Every time you launch IDA, you'll see the License Manager pop-up window. As long as there are free seats, you can borrow one of the available licenses and start using IDA.

Add-ons servers' licenses

Each of our add-ons, Teams and Private Lumina, requires a separate server to work. The server license is provided with the first IDA instance/plan with the specific add-on enabled.

Teams server activation for admins

Similar to named/computer licenses and floating license server, the Teams server license needs to be activated in My Hex-Rays portal.

Teams server installation for admins

Private Lumina server activation for admins

Similar to named/computer licenses and floating license server, the Private Lumina server license needs to be activated in the My Hex-Rays portal.

Private Lumina server installation for admins

Discover the core of Hex-Rays guides and manuals, guiding you through IDA features and real-life usage scenarios.

Getting Started

New to IDA? Explore our selection of documentation to guide you through the installation process and jumpstart your reverse engineering journey.

Our Guides

Delve into detailed guides to discover IDA features and maximize its capabilities.

Basic Usage

In this document, we'll explore the essentials of IDA capabilities to kickstart your journey and disassemble your first binary file.

Prerequisites

Before you begin

What files and processors are supported?

What are IDA database files?

IDA stores the analysis results in the IDA Database files (called IDB), with the extension .i64. This allows you to save your work and continue from the same point later. After loading a file at the beginning, IDA does not require access to the binary.

Any modifications you make are saved in the database and do not affect the original executable file.

Dive deeper

What decompilers can I work with?

IDA provides decompilers designed to work with multiple processor architectures. The number of decompilers and their type (local or remote) available in your IDA instance depends on your chosen product and subscription plan and affects your ability to produce C-like pseudocode.

Where can I find exemplary binaries to work with?

Part 1: Loading your file

When you launch IDA, you will see a Quick Start dialog that offers three ways to continue. For now, we'll focus on loading a new file and proceeding to disassembly results.

1. Launch IDA and in the Quick start dialog (1), click New.

2. Specify the path for your binary file.

3. In the Load a new file dialog (2), IDA presents loaders that are suited to deal with a selected file. Accepting the loader default selection and then the processor type is a good strategy for beginners. Click OK to confirm your selection.

1. IDA begins autoanalysis of your binary file.

Dive deeper

Part 2: UI overview

After autoanalysis is done, you'll see the main IDA desktop with the initial results. Let's examine the default desktop layout and commonly used UI elements.

1. Main menu bar (1)

2. Toolbar (2)

3. Navigation band (3)

4. Subviews (4)

5. Output (5)

6. Status bar (6)

Main menu bar

For a handy cheatsheet of all commands and their hotkeys, check Options -> Show command palette....

Dive deeper

Toolbar

Below the main menu bar, you will see a toolbar with icons that give you quick access to common functionalities (available also via the main menu/shortcuts). It has just one line by default, but you can customize it by adding or rearranging your actions.

Dive deeper

Navigation band

The navigation band shows the graphical representation of the analyzed binary file and gives a short overview of its contents and which areas may need your attention. The yellow arrow (indicator) shows where the cursor is currently positioned in the disassembly view.

As you'll soon recognize, the colors used in the nav band match those in other views.

Dive deeper

Output

Status bar

At the bottom left corner of the IDA window, you can see the status bar, which contains:

• analysis indicator AU, which shows the actual status of autoanalysis (1). In our case, it is idle, which means the autoanalysis is already finished.

• search direction indicator (2)

• remaining free disk space (3)

Right-clicking on the status bar brings up a context menu that allows you to reanalyze the program.

Dive deeper

Subviews

The subviews are one of the most prominent parts of your everyday work with IDA. These additional views (behaving like tabs) give a different perspective and information on the binary file, but the number of native IDA subviews may be a bit overwhelming. Here, we will focus on the most versatile and common subviews for beginners, where you'll spend most of the time, like:

• IDA View

• Pseudocode

• Hex Dump View

• Local Types

• Functions View

IDA View / Disassembly Window

When autoanalysis is done, you will see a graph view inside an IDA View by default. This flowchart graph should help you to understand the flow of the functions.

IDA view has three modes:

• graph view (1), that shows instructions grouped in blocks,

• linear view (2), that lists all instructions and data in order of their addresses,

• and proximity view (3), which allows you to see relations between functions, global variables, and other parts of the program.

Dive deeper

Hex View Window

In hex view, you can see the raw bytes of the program's instructions.

There are two ways of highlighting the data in this view:

1. Text match highlight, which shows matches of the selected text anywhere in the views.

2. Current item highlight, which shows the bytes group constituting the current item.

Dive deeper

Pseudocode Window

Generated by the famous F5 shortcut, the pseudocode shows the assembly language translated into human-readable, C-like pseudocode. Click Tab to jump right into the Pseudocode view.

Local Types Window

This view shows the high-level types used in databases, like structs or enums.

Dive deeper

Functions Window

This window displays all the functions recognized by IDA, along with key details for each:

• Function name

• Segment the segment that contains the function

• Start: the function starting address

• Length: the size of the function in bytes

• Local: the amount of stack space taken by local variables

• Arguments: the amount of stack space taken by arguments

This view is read-only, but you can automatically synchronize the function list with the IDA view, pseudocode, or hex view. Click to open the context menu and select Turn on synchronization.

Dive deeper

Part 3: Basic navigation

A crucial step in mastering IDA is learning how to navigate quickly to specific locations in the output. To help you get started, we'll cover essential commands and hotkeys commonly used for efficient navigation in IDA.

Double-click and jump to the location

When you double-click on an item, such as a name or address, IDA automatically jumps to that location and relocate the display.

Jump to address

1. Go to Jump -> Jump to address.. or press G hotkey

2. Enter the item name or hex address in the dialog box, then click OK.

To jump back to the previous position, press Esc. To jump to the next position, press Ctrl + Enter. You can also navigate using the arrows in the toolbar.

See the list of cross-references

1. Position the cursor on a function or instruction, then go to Jump -> Jump to xref to operand... or press X to see the dialog with listed all cross-references to this identifier.

2. Select an item from the list and click OK to jump to that location.

Dive deeper

Part 4: Manipulate your disassembly results

Now that the initial autoanalysis is done and you’ve mastered the basics of navigation, it’s time to explore the basic interactive operations that reveal the true power of IDA in transforming your analysis.

Rename a stack variable

One of the first steps you might take is to enhance readability by assigning meaningful names to local or global variables, but also functions, registers and other objects that IDA initially assigned a dummy name.

1. In the IDA View, right-click on the variable you want to rename and click Rename or press N when the variable is cursor-highlighted.

2. In the newly opened dialog, insert a new name and click OK.

If at any point you want to go back to the original dummy name given by IDA, leave the field blank and click OK. It will reset the name to the default one.

Dive deeper

Add a comment

Adding comments may be a useful way to annotate your work.

1. Highlight the line where you want to insert a comment and press :.

2. In the dialog box, type your comment (you can use multiple lines) and click OK. This will add a regular (non-repeatable) comment to the location.

Dive deeper

Part 5: Customizing IDA

Nearly every UI element is customizable, allowing you to rearrange and align widgets to suit your habits. You can save your personalized desktop layout by going to Windows -> Save desktop.

Most of the basic appearance you can change under Options menu.

• To change the colors or theme, go to Options -> Colors.

• To change the font, go to Options -> Fonts.

Part 6: Debug your file

If you are ready to delve into dynamic analysis and start debugging your programs, here are some key steps to get you started:

1. Select the right debugger and complete the setup: Go to Debugger -> Select debugger... and pick up one of the avaliable debuggers. Under Debugger -> Debugger options, you can configure the setup in detail.

2. Add breakpoints: Right-click on the line where you want to stop the execution and select Add breakpoint from the context menu, or press F2.

3. Start the process: Run the debuggin session by pressing F9 or click a green arrow on the tooltip.

Dive Deeper

Part 7: Install a plugin

One of the most common way of extanding IDA capabilities is to use on of our community-developed plugins.

Where can I find IDA plugins?

Installing your plugin

For this guide purposes, we'll walk you through general installation steps.

Load your plugin

1. Copy your plugin folder to the plugins directory inside your IDA installation directory.

2. Alternatively, you can load the plugin from the command line in IDA by using File -> Script file... and selecting app.entry.py file.

Run your plugin

1. Navigate to Edit -> Plugins -> your_plugin_name or use the assigned hotkey.

Dive deeper

Key hotkeys cheatsheet

Here's a handy list of all of the shortcuts we used so far.

• Space Switches between graph and linear mode in the IDA View

• F5 Generates pseudocode

• Tab Jumps into pseudocode View

• G Opens Jump to address dialog

• Esc Jumps back to the previous position

• Ctrl + Enter Jumps to the next position

• X Shows the list of all cross-references

• N Opens dialog to rename the current item

• ; Adds repeatable comment

• : Adds regular comment

All IDA commands are available from the followings menus:

Explore our in-depth guides, crafted to help you navigate through IDA features and master its advanced capabilities.

This submenu allows you to load additional files into the database.

Reload the input file

This command reloads the same input file into the database. IDA tries to retain as much information as possible in the database. All the names, comments, segmentation information and similar will be retained.

Only the values of individual bytes will be changed.

Load additional file

This command loads a binary file. The new file is added to the current database and all existing information is retained.

The file content will appear as unexplored bytes in the program.

This command only allows you to load binary files.

Load IDS file

This command loads an IDS file.

An IDS file contains information about well-known functions (such as functions from MS Windows API), namely:

IDS files are automatically loaded if they are found in the IDS directory. This command allows you to load an IDS file from any directory, even after the main file has been loaded into the database.

Load debug information file

This command loads a DBG file.

If the program being disassembled has a companion DBG file, then this command may be used to load information from a DBG file into the database. IDA loads DBG files automatically if it can find them in the directory with the input file.

The built-in debug information loader cannot load NB10 format files and PDB files. To load those files, please use a special plugin, PDB.DLL, which can be run manually using Edit->Plugins submenu. This plugin uses MS Windows DLLs to load the debug information and therefore has the following limitations:

Load PDB debug information file

This command loads a PDB file.

If the program being disassembled has a companion PDB file, then this command may be used to load information from the PDB file into the database.

By default IDA uses in-house code to parse and load PDB files. However, our code can not parse old v2.0 PDB files. For them, IDA can fall back to using Microsoft DLLs (the default is "do not fall back"). Please read more in cfg/pdb.cfg.

Command line switch '-Opdb:option1:option2' overrides for ida session the value in cfg/pdb.cfg.

List of options

Example

Ida will not load PDB plugin for this session.

Load TDS debug information file

This command loads a TDS file.

If the program being disassembled has a companion TDS file, this command may be used to load information from the TDS file into the database.

The TDS file must be placed in the same directory together with the input file.

The LoadTdsFile command launches a special plugin TDS.DLL which can be run manually using Edit->Plugins submenu.

Load FLIRT signature file

This command allows you to apply an additional signature file to the program.

A signature file contains patterns of standard runtime functions. With their help, IDA is able to recognize the standard functions and names them accordingly.

IDA attempts to detect the necessary signature files automatically but unfortunately, this is not always possible. This command adds the specified signature file into the planned signature files queue.

Signature files reside in the subdirectories of the SIG directory. Each processor has its own subdirectory. The name of the subdirectory is equivalent to the name of the processor module file (z80 for z80.w32, for example). Note: IBM PC signatures are located in the SIG directory itself. Note: the IDASGN environment variable can be used to specify the location of the signatures directory.

There is another way to load a signature file: you may insert/delete signature files in the following way:

This is a preferred way of applying signatures because useful information, such as the number of identified functions is displayed in the signature window.

Load C header

This command allows you to apply type declarations from a C header file to the program.

IDA reads and parses the specified header file as a C compiler does. In other words, it mimics the front-end of a C compiler with some restrictions:

In the case of an error in the input file, the error messages appear in the message window. In any case, the function declarations that are already parsed are not deleted from the database. IDA stops parsing the input file when 20 errors occur.

See also

IDAClang plugin

To enable the IDAClang parser, go to Options>Compiler>Source parser, and select "clang". Then use 'File>Load file>Parse C header file' to invoke the parser on a given source file.

Since IDAClang is based on the third-party libclang parser, it can only parse standalone source files that contain valid C/C++/Objective-C syntax.

In this submenu you can:

 Action    name: SaveBase
 

This command saves and packs the current database.

See also other File... submenu commands. Save database as... command.

 Action    name: SaveBaseSnap
 

This command takes a database snapshot. The snapshot can be later restored from the database snapshot manager.

Note: snapshots work only with regular databases. Unpacked databases do not support them.

See also View database snapshot manager commands.

Abort IDA

 Action    name: Abort
 

This command terminates the current IDA session. The Abort command is not available if the database was not packed.

IDA will NOT save changes to the disk.

See also other File... submenu commands. Quit command.

 Action    name: ExecuteLine
 

You can enter and execute a small script written in the built-in IDC language or any other registered extlang.

Here is the list of built-in functions.

See also:

• IDC language overview

• Execute script file command

• File... submenu commands

• How to use notepad.

 Action    name: Shell
 

By using this command, you can temporarily quit to the operating system.

This command is not available in the MS DOS version.

The database is left open when you use this command, so be careful.

See also other File... submenu commands.

This submenu allows you to produce various output files. It also allows you to unload the database.

The text file-producing operations below will make use of

• the currently-selected encoding for output files.

• Generate MAP file

• Generate ASM file

• Generate INC file

• Generate LST file

• Generate EXE file

• Generate DIF file

• Generate HTML file

• Generate flow chart GDL file

• Generate call graph GDL file

• Dump database to IDC file

• Dump typeinfo to IDC file

• Create C header file

Create MAP File

 Action    name: ProduceMap
 

Please enter a file name for the map. IDA will write the following information about this file:

  - current segmentation
  - list of names sorted by values

You may disable the generation of the segmentation information. You may also enable or disable dummy names in the output file.

You can use this map file for your information, and also for debugging (for example, Periscope from Periscope Company or Borland's Turbo Debugger can read this file).

Create ASM File

 Action    name: ProduceAsm
 

Please enter a file name for the assembler text file. IDA will write the disassembled text to this file.

If you have selected a range on the screen using Drop Anchor command, IDA will write only the selected range (from the current address to the anchor).

If some I/O problem (e.g. disk full) occurs during writing to the file, IDA will stop and a partial file will be created.

Create INC File

 Action    name: ProduceInc
 

Please enter a file name for the assembler include file. IDA will write the information about the defined types (structures and enums) to this file.

If some I/O problem (e.g. disk full) occurs during writing to the file, IDA will stop and a partial file will be created.

Create LST File

 Action    name: ProduceLst
 

Enter a file name for the assembler listing file. IDA will write the disassembled text to this file.

If you've selected a range on the screen using Drop Anchor command, IDA will write only the selected range (from the current address to the anchor).

If some I/O problem (e.g. disk full) occurs during writing to the file, IDA will stop and a partial file will be created.

Create Executable File

 Action    name: ProduceExe
 

Enter a file name for the new executable file. Usually this command is used after patching (see commands Patch byte and Patch word) to obtain a patched version of the file.

IDA produces executable files only for:

  - MS DOS .exe
  - MS DOS .com
  - MS DOS .drv
  - MS DOS .sys
  - general binary
  - Intel Hex Object Format
  - MOS Technology Hex Object Format

For other file formats please create a difference file.

EXE files: Output files will have the same EXE-header and relocation table as the input file. IDA will fill unused ranges of the EXE file (e.g. between relocation table and loadable pages) with zeroes.

See also Edit|Patch core submenu.

Create Difference File

 Action    name: ProduceDiff
 

This command will prompt you for a filename and then will create a plain text difference file of the following format:

 comment

 filename
 offset: oldval  newval

See also Edit|Patch core submenu.

Create HTML File

 Action    name: ProduceHtml
 

Please enter a file name for the HTML file. IDA will write the disassembled text to this file.

If you've selected a range on the screen using Drop Anchor command, IDA will write only the selected range (from the current address to the anchor).

If some I/O problem (e.g. disk full) occurs during writing to the file, IDA will stop and a partial file will be created.

This command is available only in the graphical version of IDA.

Produce flow chart GDL file

 Action    name: ProduceFuncGdl
 

This command creates a GDL (graph description file) with the flow chart of the current function.

If there is an active selection, its flow chart will be generated.

IDA will ask for the output file name. Regardless of the specified extension, the .GDL extension will be used.

Produce call graph GDL file

 Action    name: ProduceCallGdl
 

This command creates a GDL (graph description file) with the graph of the function calls.

IDA will ask for the output file name. Regardless of the specified extension, the .GDL extension will be used.

Dump database to IDC file

 Action    name: DumpDatabase
 

This command saves current IDA database into a text file.

You can use it as a safety command:

  - to protect your work from disasters
  - to migrate information into new database formats of IDA.

This command is used when you want to switch to a new version of IDA. Usually each new version of IDA has its own database format. To create a new format database, you need:

  1. to issue the 'Dump...' command for the old
     database (using old version of IDA). You will
     get an IDC file containing all information
     from your old database.
  2. to reload your database using new IDA with switch -x.
  3. to compile and execute the IDC file with command
    'Execute IDC file' (usually F2)

Please note that this command does not save everything to text file. Any information about the local variables will be lost!

Create C header file

 Action    name: ProduceHeader
 

This command saves all definitions in the local types window into a C header file.

Dump typeinfo to IDC file

 Action    name: DumpTypes
 

This command saves information about the user-defined types from the IDA database into a text file.

Information about enums, structure types and other user-defined types is saved in a text form as an IDC program.

You can use this command to migrate the type definitions from one database to another.

See also other File... submenu commands.

This command terminates the current IDA session. IDA will write all changes to the disk and will close all databases.

You can also perform garbage collection on the database before packing it. The garbage collection removes the unused database pages, making it smaller. However, IDA needs some free database pages when it works,therefore it will allocate them again when you reuse the database. Removing and adding free pages takes time and, what is most important, it changes the database control blocks.

Use garbage collection only when you do not intend to work with the database in the near future.

This command reverts the database to the state before executing the last user action. It is possible to apply Undo multiple times, in this case multiple user actions will be reverted.

Since there is a limit on the size of undo buffers, any action, even the tiniest, may become non-undoable after some time. This is true because the analysis or plugins may continue to modify the database and overflow the buffers. Some massive actions, like deleting a segment, may be non-undoable just because of the sheer amount of undo data they generate.

Please note that Undo does not affect the state of IDC or Python scripts. Script variables will not change their values because of Undo. Also nothing external to the database can be changed: created files will not be deleted, etc.

Some actions cannot be undone. For example, launching a debugger or resuming from a breakpoint cannot be undone.

See also

This submenu allows the user to modify text representation and to patch the file. It also has the commands to control the analysis:

This command clears the undo history. After it the Undo and Redo commands become unavailable. However, once the user performs a new action, IDA will again start journaling all database modifications.

A side effect of this command is fast autoanalysis: since there is no user action to revert yet, IDA does not maintain undo buffers and this speeds up the analysis.

See also

 Action    name: Redo
 

This command reverts the previously issued Undo command. It is possible to use Redo multiple times.

This command also reverts all changes that were done to the database after the last Undo command, including the eventual useful modifications made by the autoanalysis. In other words, the entire database is modified to get to the exact state that it had before executing the last Undo command.

See also

• Undo

• Reset Undo

• Disable Undo

• Open undo history

 Action    name: MakeCode
 

This command converts the current unexplored bytes to instruction(s). IDA will warn you if it is not possible.

If you have selected a range using the [anchor](../../../disassembler/navigation/anchor.md, all the bytes from this range will be converted to instructions.

If you apply this command to an instruction, it will be reanalyzed.

See also Edit submenu

 Action    name: MakeUnknown
 

This command deletes the current instruction or data, converting it to 'unexplored' bytes. IDA will delete the subsequent instructions if there are no more references to them (functions are never deleted).

If you have selected a range using the anchor, all the bytes in this range will be converted into 'unexplored' bytes. In this case, IDA will not delete any other instructions even if there are no references to them after the deletion.

See also Edit submenu

 Action    name: DisableUndo
 

This command completely disables the undo feature.

See also

• Undo

• Redo

• Reset Undo

• Open undo history

 Action    name: MakeData
 

This command converts the current unexplored bytes to data. If it is not possible, IDA will warn you.

Multiple using of this command will change the data type:

 db -> dw -> dd -> float -> dq -> double -> dt -> packreal -> octa \;
 ^                                                                 |;
 \---------<----------------<--------------<-----------------------/;

You may remove some items from this list using setup data command.

If the target assembler does not support double words or another data type, it will be skipped. To create a structure variable, use Declare struct var command. To create an array, use Array command. To convert back, use Undefine command. See also Edit submenu

 Action    name: MakeArray
 

This command allows you to create arrays and change their sizes.

The arrays are created in 2 simple steps:

1. Create the first element of array using the data definition commands (data, string, structs)

2. Apply the array command to the created data item. Enter array size in current array elements (not bytes). The suggested array size is the minimum of the following values:

   Copy

        - the address of the next item with a cross reference
        - the address of the next user-defined name

For string literals, you can use this command to change the length of the string.

The dialog box contains the following fields:

Items on a line (meaningless for string literals):

        0               place maximal number of items on a line
        other value     number of items on a line

Please note that the margin parameter affects the number of items on a line too.

Alignment (meaningless for string literals):

        -1              do not align items
        0               align automatically
        other value     width of each item

 Signed elements:       if checked, IDA treats all elements as signed numbers.
                        only meaningful for numbers (not for offsets and
                        segments and strings)

 Display indexes:       if checked, IDA will display the indexes of array
                        elements in the form of comments (0,1,2...)

 Create as array:       if not checked, IDA will create a separate item for
                        each array element. Useful for creating huge arrays.
                        If the box is unchecked when this command is
                        applied to string literals, IDA will create many
                        string literals instead of one big string.

If applied to a variable-sized structure, this command is used to specify the overall size of the structure. You cannot create arrays of variable-sized structures.

See also:

• Edit submenu

• How to Enter a Number.

Convert to string literal

 Action    name: MakeStrlit
 

This command converts the current unexplored bytes to a string.

The set of allowed characters is specified in the configuration file, parameter StrlitChars. Character '\0' is not allowed in any case. If the current assembler does not allow characters above 0x7F, characters with high bit set are not allowed.

If the anchor has been dropped, IDA will take for the string all characters between the current cursor position and the anchor.

Use the anchor if the string starts a disallowed character.

This command also generates a name for the string. In the configuration file, you can specify the characters allowed in names (NameChars).

You can change the literal string length using Array command.

The GUI version allows you to assign a special hotkey to create Unicode strings. To do so, change the value of the StringUnicode parameter in the IDAGUI.CFG file.

Pascal Strings

To create Pascal style strings (with first byte indicating string length) use Set String Style command.

See also Edit submenu

 Action    name: MakeName
 

This command gives name/renames/deletes name for the current item.

To delete a name, simply give an empty name.

If the current item is referenced, you cannot delete its name. Even if you try, IDA will generate a dummy name.

Local name

  The name is considered to be defined only in the current function.
  Please note that IDA does not check the uniqueness of the local names
  in the whole program. However, it does verify that the name is unique for the
  function.

Include in name list

Here you can also include/remove the name from the name list. If the name is hidden, you will not see it in names window.

Public name

  You can declare a name as a public (global) name. If the current
  assembler supports the "public" directive, IDA will use it.
  Otherwise, the publicness of the name will be displayed as a comment.

Autogenerated name

  An autogenerated name will appear in a different color.
  if the item is indefined, it will disappear automatically .

Weak name

  You can declare a name as a weak name. If the current
  assembler supports the "weak" directive, IDA will use it.
  Otherwise, the weakness of the name will be displayed as a comment.

Create name anyway

  If this flag is on, and if the specified name already exists,
  IDA will try to variate the specified name by appending a suffix to it.

See also Edit submenu. How to Enter an Identifier. Names representation.

If you have selected a range before applying an operand conversion command, IDA will display a dialog box.

You can choose a range of operands to perform an en masse operation:

 ALL OPERANDS
 -----------

The operation will be performed on all operands as a toggle. For example, if you ask to convert to a character, then all non-character operands will become characters, and all character operands will become non-chars.

 OPERAND VALUE RANGE
 -------------------

The operation will be performed on the void operands which contain immediate numbers in the specified range.

 ... OPERANDS
 ------------

This selection will convert all operands with the specified type to undefined operands. Example: all characters become non-characters.

 NOT ... OPERANDS
 ---------------

This selection allows to convert all operands that do not have the specified type to the specified type. Example: all non-characters to characters.

 NOT TYPED OPERANDS
 -----------------

This selection allows to convert all operands without any type to the specified type. Example: all operands with no type to characters.

 APPLY ONLY IF POSSIBLE
 ---------------------

IDA will check whether an operand can be represented with the specified type (as a character constant, for example), and perform type conversion only if the check is successful.

 Action    name: OpChar
 

This command converts immediate operand(s) type of the current instruction/data to character.

When you use this command, IDA deletes the manually entered operand.

If the cursor is on the first operand (the cursor is before ',') then the first operand will be affected; otherwise, all other operands will be affected.

See also Edit|Operand types submenu.

Convert operand to number

The number is represented in the default radix for the current processor (usually hex, but octal for PDP-11, for example).

If the cursor is on the first operand (the cursor is before ',') then the first operand will be affected; otherwise, all other operands will be affected.

Convert operand to hexadecimal number

If the cursor is on the first operand (the cursor is before ',') then the first operand will be affected; otherwise, all other operands will be affected.

Convert operand to decimal number

This command converts the immediate operand(s) type of the current instruction/data to decimal. Therefore, it becomes a 'number'.

If the cursor is on the first operand (the cursor is before ',') then the first operand will be affected; otherwise, all other operands will be affected.

Convert operand to octal number

This command makes the current instruction or data operand type octal. IDA always uses 123o notation for octal numbers even if the current assembler does not support octal numbers.

If the cursor is on the first operand (the cursor is before ',') then the first operand will be affected; otherwise, all other operands will be affected.

Convert operand to binary number

This command makes the current instruction or data operand type binary. IDA always uses 123b notation for binary numbers even if the current assembler does not support binary numbers.

If the cursor is on the first operand (the cursor is before ',') then the first operand will be affected; otherwise, all other operands will be affected.

Convert operand to floating point number

This command makes the current operand type floating point.

If the cursor is on the first operand (the cursor is before ',') then the first operand will be affected; otherwise, all other operands will be affected.

Toggle leading zeroes

This command displays or hides the leading zeroes of the current operand. Example: if the instruction looked like this:

then after applying the command it will look like this:

This submenu allows you to change the operand types to offsets, numbers, chars, etc. Use it to make disassembled text more understandable.

• Convert operand to offset

• Convert operand to number

• Convert operand to character

• Convert operand to segment

• Convert operand to enum

• Convert operand to stack variable

• Change operand sign

• Bitwise negate operand

• User-defined operand

• Set operand type

If IDA suspects that an operand can be represented as something different from a plain number, it will mark the operand as "suspicious" and show it in red. Use these commands to delete suspicious marks.

Some of these commands can be applied to a selected range. Click here to learn about the rules applied to such operations.

See also Edit submenu.

• Convert operand to offset (data segment)

• Convert operand to offset (code segment)

• Convert operand to offset (any segment)

• Convert operand to offset (user-defined base)

• Convert operand to struct offset

Convert operand to offset (data segment)

 Action    name: OpOffset
 

This command converts the immediate operand of the current instruction/data to an offset from the current data segment (DS).

If current DS value is unknown (or equal 0xFFFF) IDA will warn you -- it will beep. In this case, you have to define DS register value for the current byte. The best way to do it is:

• jump to segment register change point

• change value of DS

• return or you can change default value of DS for the current segment.

If you want to delete offset definition, you can use this command again - it works as trigger.

If the cursor is on the first operand (the cursor is before ',') then the first operand will be affected; otherwise, all other operands will be affected.

If a range is selected using the anchor, IDA will perform 'en masse' conversion. It will convert immediate operands of all instructions in the selected range to offsets. However, IDA will ask you first the lower and upper limits of immediate operand value. If the operand value is >= lower limit and <= upper limit then the operand will be converted to offset, otherwise it will be left unmodified.

To create offsets to structure members use Convert to struct offset command.

See also:

• Enter the operand manually command.

• Set operand type

Convert operand to offset (code segment)

 Action    name: OpOffsetCs
 

This command converts the immediate operand of the current instruction/data to an offset from the current segment (CS).

If the cursor is on the first operand (the cursor is before ',') then the first operand will be affected; otherwise, all other operands will be affected.

If a range is selected using the anchor, IDA will perform 'en masse' conversion. It will convert immediate operands of all instructions in the selected range to offsets. However, IDA will ask you first the lower and upper limits of immediate operand value. If the operand value is >= lower limit and <= upper limit then the operand will be converted to offset, otherwise, it will be left unmodified.

If this command is applied to a structure member in the local types window, then IDA will create an "automatic offset". An automatic offset is an offset with the base equal to 0xFFFFFFFF. This base value means that the actual value of the base will be calculated by IDA when a structure instance is created.

To create offsets to structure members, use Convert to struct offset command.

See also:

• Enter #th operand manually commands.

• Set operand type

Convert operand to offset (any segment)

 Action    name: OpAnyOffset
 

This command converts the immediate operand of the current instruction/data to an offset from any segment.

IDA will ask to choose a base segment for the offset.

If a range is selected using the anchor, IDA will perform 'en masse' conversion. It will convert immediate operands of all instructions in the selected range to offsets. However, IDA will ask you first the lower and upper limits of immediate operand value. If the operand value is >= lower limit and <= upper limit then the operand will be converted to offset, otherwise it will be left unmodified.

If the cursor is on the first operand (the cursor is before ',') then the first operand will be affected; otherwise, all other operands will be affected.

To create offsets to structure members use Convert to struct offset command.

See also:

• Enter #th operand manually commands.

• Set operand type

Convert operand to offset (user-defined base)

Action    name: OpUserOffset

If the cursor is on the first operand (the cursor is before ',') then the first operand will be affected; otherwise, all other operands will be affected.

If the offset base is specified as 0xFFFFFFFF, then IDA will create "an automatic offset". Automatic offsets mean that the actual value of the base will be calculated by IDA.

The following offset attributes are available:

  Treat the base address as a plain number

        if checked, IDA will treat the base address as a number.
        In this case, IDA will not create a cross-reference to it
        and the base address will be printed as a number,
        not as an offset expression.

  Offset points past the main object

        Offsets of this type point past an object end.
        They do not cause an object created/deletion.

  Use image base as offset base

        These offsets are based on the image base.
        There is no need to explicitly specify the offset base.
        These offsets are displayed in a concise form:
          rva func
        instead of
          offset func - imagebase
        If you intend to reassemble the output file, execute the
        following IDC statement:
        set_inf_attr(INF_GENFLAGS, get_inf_attr(INF_GENFLAGS) & ~INFFL_ALLASM);

  Subtract operand value

        Use this option when the operand value should be substracted
        from the base to get the target address. In this case the displayed
        expression will be displayed as
          offset base - target
        instead of the usual
          offset target - base

  Signed operand

        Use this option if the operand should be interpreted
        as a signed value. This option is only available for OFF_REF8,
        OFF_REF16, OFF_REF32 and OFF_REF64 offset types.

  Operand value of 0 is invalid

        If the operand value is 0, the value will be highlighted in red.

  Operand value of NOT 0 is invalid

        If the operand value is zero's complement (i.e. all bits are set),
        the value will be highlighted in red.
        For example a OFF_REF16 with an operand value of 0xFFFF would be invalid.

  Use the current address as the offset base

The offset base is dynamically calculated and is equal to the address of the current element:

• for standalone items: their start address

• for arrays: the start of the array element

• for structures: the start of the structure field The offset expression is displayed in the following concise form: offset target - $ where "$" denotes the start of the element (and is assembler-dependent). To create offsets to structure members use Convert to struct offset command.

See also:

• Enter #th operand manually commands.

• Set operand type

Convert operand to structure offset

 Action    name: OpStructOffset
 

 GUI version:
 ------------

This command permits to convert all immediate operands of instructions in a range selection to a path of offsets through a structure and its possible sub unions. If no selection is active, IDA will simply permit to convert the current operand. In this case, it will display a simple dialog box the same way as the text version (see below).

You can select the desired register in the drop-down list: all operands relative to this register will be added to the 'Offsets' list. A special empty line in the drop-down list is used to directly work on immediate values. Checkboxes in the 'Offsets' list allow you to select which operand you indeed want to modify. By default, IDA will select only undefined operands, to avoid overwriting previous type definitions. This list is sorted by operand value, by instruction address and finally by operand number. You can easily see the instructions related to the operand by moving the mouse over it, and wait for a hint to be displayed.

The 'Structures and Unions' tree will contain all selectable structures, and sub unions. Once you select or move over a structure, the 'Offsets' list updates itself for each checked offset: the computed name of the operand is displayed, according to the selected structure in the tree. An icon is also drawn, to easily know if a specific structure matchs the offset or not, or if the offset is too big for the selected structure. The structures who match the most offsets will be near the top of the tree. You can also move your mouse over structures in the tree to obtain an interesting hint.

A '?' icon can also appear, if the offset can be specialized by selecting an union member. In this case, if you expand the structure in the tree, you can select the adequate union member simply by checking the desired radio button. IDA automatically corrects the related name in the 'Offsets' list.

The 'Offset delta' value represents the difference between the structure start and the pointer value. For example, if you have an operand 4 and want to convert in into an expression like "mystruct.field_6-2", then you have to enter 2 as the delta. Usually the delta is zero, i.e. the pointer points to the start of the structure.

The 'Hide sub structures without sub unions' option (checked by default) avoids to add unnecessary sub structures to the tree, to keep it as small as possible. If you uncheck this option, all sub structures will be added to the tree.

By default, IDA displays the structure member at offset 0. To change this behaviour, you can directly disable the 'Force zero offset field' in the 'Options' frame. Later zero offsets can be forced using Edit, Structs, Force zero offset menu item.

 Text version:
 -------------

This command converts immediate operand(s) type of the current instruction/data to an offset within the specified structure. Before using this command, you have to define a structure type.

First of all, IDA will ask a so-called "struct offset delta". This value represents the difference between the structure start and the pointer value. For example, if you have an operand 4 and want to convert in into an expression like "mystruct.field_6-2", then you have to enter 2 as the delta. Usually the delta is zero, i.e. the pointer points to the start of the structure.

If a range is selected using the anchor, IDA will perform 'en masse' conversion. It will convert immediate operands of all instructions in the selected range to offsets. However, IDA will ask you first the lower and upper limits of immediate operand value. If the an operand value is >= lower limit and <= upper limit then the operand will be converted to offset, otherwise it will be left unmodified.

When you use this command, IDA deletes the manually entered operand.

If the cursor is on the first operand (the cursor is before ',') then the first operand will be affected; otherwise, all other operands will be affected.

By default IDA doesn't display the structure member at offset 0. To change this behaviour, use Force zero field offset command.

Moreover, if there are several possible representations (this can happen if unions are used), select the desired representation using the Select union member... command.

See also:

• Enter #th operand manually command.

• Set operand type

Related topics: Edit|Operand types submenu.

 Action    name: OpSegment
 

This command converts the immediate operand(s) type of the current instruction/data to segment base. The segment bases are usually displayed like this:

        mov     ax, seg dseg

When you use this command, IDA deletes the manually entered operand.

If IDA cannot find a segment whose base is equal to the operand value, it simply displays it as hex number.

If the cursor is on the first operand (the cursor is before ',') then the first operand will be affected; otherwise, all other operands will be affected.

See also Edit|Operand types submenu.

 Action    name: OpEnum
 

This command converts immediate operand(s) type of the current instruction/data to an enum member. Before using this command, you have to define an enumeration type.

If the selected enum is a bitfield, IDA will try to build a bitfield expression to represent the constant. Please note that for bitfields having multiple constants with the same value some expressions won't be possible.

If a range is selected using the anchor, IDA will perform 'en masse' conversion. It will convert immediate operands of all instructions in the selected range to symbolic constants. However, IDA will ask you first the lower and upper limits of immediate operand value. If the operand value is >= lower limit and <= upper limit then the operand will be converted to offset, otherwise it will be left unmodified.

When you use this command, IDA deletes the manually entered operand.

If the cursor is on the first operand (the cursor is before ',') then the first operand will be affected; otherwise all other operands will be affected.

See also: Edit|Operand types submenu. Enter #th operand manually commands. Set operand type

A complex offset expression looks like

        offset target + delta - offset base

It is specified by:

        - type (OFF16, OFF32, LOW16, etc.)
        - base
        - optional target
        - optional delta from target

The relationship between these parameters is (the formula is given for full offsets):

        operand_value = target + delta - base

  or (the same relationship in a different form):

        target = operand_value - delta + base

You always have to specify the offset type and base. Usually, the delta is equal to zero. For the full offset type you may omit the offset target, which is recommended. In this case, IDA will calculate it automatically. However, if you specify the offset target, make sure that the relationship between the parameters still holds. For the half offset types, you have to specify the target because there is no way to calculate it.

The offset types:

  8-bit full offset            :
  16-bit full offset           :
  32-bit full offset           :

    The full offsets are regular offset expressions like

        offset label

    They can occupy 8, 16, or 32 bits.
    You have to specify the offset base for these offsets.

  low 8 bits of 16-bit offset  :

    Only the low 8 bits of the offset. IDA will represent them as

        (offset label) & 0xFF

  low 16 bits of 32-bit offset :

    Only the low 16 bits of the offset. IDA will represent them as

        (offset label) & 0xFFFF

  high 8 bits of 16-bit offset :

    Only the high 8 bits of the offset. IDA will represent them as

        offset label >> 8

  high 16 bits of 32-bit offset:

    Only the high 17 bits of the offset. IDA will represent them as

        offset label >> 16

See also offset by any user-specified base

 Action    name: OpStackVariable
 

This command converts immediate operand(s) type of the current instruction to an offset to stack variables, i.e. a local variable or function argument in the stack.

You need to define stack variables before using this command.

If the current operand is based on the value of the stack pointer ([ESP+xxx]) and the SP value is traced incorrectly, then you need to correct SP value using change stack pointer command.

If a range is selected using the anchor, IDA will perform 'en masse' conversion. It will convert immediate operands of all instructions in the selected range to stack variables. However, IDA will ask you first the lower and upper limits of immediate operand value. If the operand value is >= lower limit and <= upper limit then the operand will be converted to stack variable, otherwise it will be left unmodified.

When you use this command, IDA deletes the manually entered operand.

If the cursor is on the first operand (the cursor is before ',') then the first operand will be affected; otherwise all other operands will be affected.

See also: Edit|Operand types submenu. Enter #th operand manually commands. Define stack variables...

This command changes the sign of the current operand. Please note that not all operands can change their sign.

You may specify any string instead of an operand if IDA does not represent the operand in the desired form. In this case, IDA will simply display the specified string in the instruction instead of the default operand.

The current operand (under the cursor) will be affected.

You can use this command not only with instructions but with data items too.

IDA proposes the previous manual operand as the default value in the input form.

To delete the manual operand and revert back to the default text, specify an empty string.

NOTE: A text offset reference is generated if you use a label in the program as the operand string. In other cases no cross-references are generated.

This command allows you to specify the type of the operand under the cursor.

The operand type must be entered as a C declaration. Currently IDA itself does not use the operand type information. However, it can be used by the Hex-Rays decompiler plugin. Setting operand type is most useful in case of indirect calls: the decompiler will use the type information to determine the input parameters to the call instead of guessing, which can make the decompiled code better.

An example of a type declaration:

To delete a type declaration, enter an empty string.