Loading...
Loading...
Loading...
Loading...
Loading...
Loading...
Loading...
Loading...
Loading...
Loading...
Loading...
Loading...
Loading...
Loading...
Loading...
Loading...
Loading...
Loading...
Loading...
Loading...
Loading...
Loading...
Loading...
Loading...
Loading...
Loading...
Loading...
Loading...
Loading...
Loading...
Loading...
Loading...
Loading...
Loading...
Loading...
Loading...
Loading...
Loading...
Loading...
Loading...
Loading...
Loading...
Loading...
Loading...
Loading...
Loading...
Loading...
Loading...
Loading...
Loading...
Loading...
Loading...
Loading...
Loading...
Loading...
Loading...
Loading...
Loading...
Loading...
Loading...
Loading...
Loading...
Loading...
Loading...
Loading...
Loading...
Loading...
Loading...
Loading...
Loading...
Loading...
Loading...
Loading...
Loading...
Loading...
Loading...
Loading...
Loading...
Loading...
Loading...
Loading...
Loading...
Loading...
Loading...
Loading...
Loading...
Loading...
Loading...
Loading...
Loading...
Loading...
Loading...
Loading...
Loading...
Loading...
Loading...
With IDA 9.0, we changed how the Hex-Rays documentation is organized and added new guides and tutorials to kickstart your IDA journey and ease the migration from previous IDA versions.
Our docs are divided into three main categories:
User Guide, dedicated to individual users and covering whole IDA products (including add-ons, like Teams and Lumina). Most of the documentation regarding IDA, like manuals or tutorials, is currently accessible under the User Guide.
Developer Guide, which focuses on developer's needs, covers the reference and contextual documentation for IDAPython API and C++ SDK, as well as native IDC language. This part is mainly dedicated to plugin authors and devs interested in enhancing basic IDA capabilities with our development kit or scripting.
Admin Guide mainly focuses on administrators installing and managing servers for Teams and Lumina or floating licenses.
In Archive, we gathered docs with rather historical value that some of you may still find interesting but focused on previous versions of IDA.
We prepared a Getting Started section for IDA newbies and also gathered additional materials to help you find your way around our IDAPython API or IDA SDK.
For those familiar with previous versions of IDA, we prepared Porting Guides for IDAPython and C++ SDK. If you use the Flexera server for floating licenses, check our Migration Guide for new Hex-Rays license server.
Discover the core of Hex-Rays guides and manuals, guiding you through IDA features and real-life usage scenarios.
New to IDA? Explore our selection of documentation to guide you through the installation process and jumpstart your reverse engineering journey.
Delve into detailed guides to discover IDA features and maximize its capabilities.
First experience with IDA? Great, you are in the right place. Here you can find guides designed to quickly onboard you into IDA. We will walk you through license activation and IDA installation to the essential tasks you can perform in IDA.
Get your IDA instance up and running on your local machine.
Check how to handle your license key file to keep IDA subscription active.
Reverse your first binary file and discover the capabilities of disassembly and decompilation.
Explore the main IDA interface and features, learn how to customize your experience and take advantage of plugins or utilities.
Discover our Developer Kit, featuring the IDA C++ SDK and IDAPython API. Additionally, explore the IDC scripting language.
Check how to install and manage Teams and Lumina servers as well as handle floating licenses.
Check how to activate your license in My Hex-Rays portal.
Get smoothly through installation process on your machine.
Check basic features of IDA and reverse your first binary.
By following the steps in this guide, you can successfully install your IDA instance on macOS, Linux, and Windows.
The installation steps are valid for all product versions: IDA Pro, IDA Home, or IDA Free (except license registration).
This installation guide is dedicated to individual users.
macOS 12 (Monterey) or later (x64 or ARM64)
x64 (x86_64) CentOS 7 or later, Ubuntu 16.04 or later. Other equivalent distributions may work but not guaranteed.
Windows 8 or later (x64)
Activate your named or computer license via My Hex-Rays portal.
Prerequisites:
Ensure that you have activated your computer/named license and downloaded your license file (ida.hexlic) locally.
Make sure Python 3 or later is installed on your computer for the IDAPython API to function properly.
Step 1: Download the installer
Download the macOS version of IDA Pro from Download Center in My Hex-Rays portal.
Step 2: Run the installer
Extract the .zip archive.
Double-click on the extracted file to run the instalation wizard.
Follow the wizard's instructions to complete the installation:
accept the license agreement and installation directory;
copy your ida.hexlic
file to IDA installation directory or to $HOME/.idapro
directory before launching IDA.
Step 4: Launch IDA Pro for the first time
Double-click on the IDA Pro icon to launch the application.
Step 5: Point to your named/computer license
The step below is valid for named and computer licenses for individual use. If you are going to use floating licenses, check this alternative step.
In the License manager pop-up window, specify the path of your license file and click OK.
You won't be asked about your license again unless the subscription period expires or you move your license file to a different location.
Prerequisites:
Ensure that you have activated your computer/named license and downloaded your license file (ida.hexlic) locally.
Make sure Python 3 or later is installed on your computer for the IDAPython API to function properly.
Verify that you have the required libraries installed. Use your package manager to install any missing dependencies. Common dependencies include libx11
, libxext
, libxrender
, and libglib2.0
.
Step 1: Download the installer
Download the Linux version of IDA Pro from Download Center in My Hex-Rays portal.
Step 4: Run the installer
Navigate to the directory containing your IDA installer, and make it executable.
Run the installer by double-click it or enter ./<your_IDA_version_>linux.run
in the terminal to execute it.
Follow the wizard's instructions to complete the installation:
accept the license agreement and installation directory;
copy your ida.hexlic
file to IDA installation directory or to $HOME/.idapro
directory before launching IDA.
Step 5: Launch IDA Pro for the first time
Go to the directory where IDA is installad and run the command: ./ida90
Step 6: Point to your named/computer license
The step below is valid for named and computer licenses for individual use. If you are going to use floating licenses, check this alternative step.
In the License manager pop-up window, specify the path of your license file and click OK.
You won't be asked about your license again unless the subscription period expires or you move your license file to a different location.
Ensure that you have activated your computer/named license and downloaded your license file (ida.hexlic) locally.
Make sure Python 3 or later is installed on your computer for the IDAPython API to function properly.
Step 1: Download the installer
Download the Windows version of IDA Pro from Download Center in My Hex-Rays portal .
Step 2: Run the installer
Locate the downloaded .exe
file and double-click it to run the installer.
Follow the installation wizard's instructions to complete the installation:
accept the license agreement and installation directory;
copy your ida.hexlic
file to IDA installation directory or to %APPDATA%/Hex-Rays/IDA Pro
directory before launching IDA.
Step 5: Launch IDA Pro for the first time
Navigate to the Start Menu or desktop shortcut and launch IDA Pro.
Step 6: Point to your named/computer license
The step below is valid for named and computer licenses for individual use. If you are going to use floating licenses, check this alternative step.
In the License Manager pop-up window, specify the path of your license file and click OK.
You won't be asked about your license again unless the subscription period expires or you move your license file to a different location.
Step 1: In the License manager pop-up window, select the option Use floating license server and then type a license server hostname provided by your administrator.
Step 2: Borrow one of the licenses visible under the available licenses list and click OK.
Note that you don't need a license file stored on your machine locally while using floating licenses.
Step 1: Update IDA Pro
After installation, check for any available updates. Hex-Rays often releases patches and updates for IDA Pro. You can check for updates within the application via Help -> Check for free update or download the latest version from My Hex-Rays portal.
Step 2: Configure environment (optional)
Customize your IDA Pro environment settings to suit your preferences. This can include configuring hotkeys, and adjusting appearance settings.
Step 3: Install additional plugins (optional)
You can extend the functionality of IDA Pro by installing additional plugins that can be found on the official Hex-Rays website or other trusted sources in the reverse engineering community.
You can execute any script file supported by the built-in scripting engine ( or Python), or a scripting language added by a plugin. The scripting language to use is selected by the file name extension of the script.
See also of script commands, commands.
In this document, we covered the basics regarding our licensing model: you can check how to activate your license depending on the license type, what to do with the downloaded license files, and how to finalize license settings while running IDA. This guide is dedicated to individual users.
In Hex-Rays, we offer two basic license types for IDA products, that are suitable for individual users:
Named licenses, that are assigned to specific individuals.
Computer licenses that are assigned to specific devices.
There is also an additional type, called floating licenses, that allow a set number of concurrent users but are not assigned to specific individuals or devices.
Floating licenses are available only for IDA Pro and dedicated to business/organization purposes.
The license file contains your license ID and other data and is required to make your IDA instance fully operative after installation.
You can download your license file from My Hex-Rays portal, after its activation.
To complete the installation, you need an active IDA license with an assigned owner or a MAC address. Without activation, you cannot download your license file.
for named licenses: the email address of the owner,
for computer licenses: the MAC address of a specific device
for floating licenses: the MAC address of the device where the license server will be running
The license type (named/computer) is selected when you purchase your subscription.
Go to My Hex-Rays portal. On the left menu, select a customer to see licenses assigned to it.
Navigate to Licenses -> Subscriptions. On the list, find the license ID and product for which you want to activate the license. Under Actions column, click on the three dots, and then in the dropdown menu, click Activate license.
Your product's license needs to be in a Pending activation status to activate. If you haven't done so before, you'll need to undergo the KYC procedure for paid products.
In the new dialog, assign the ownership of the license: set the email address for this IDA instance user (it can be yours) and select decompilers. Optionally, select a Lumina and Teams server and tick the checkbox to send your license via email.
Click Assign button and then Click to confirm to finalize the assignment.
In the main subscriptions view, click on the three dots under Actions column, and in the dropdown menu, click Download license key to save it locally. You will need it to complete the installation process.
Navigate to the Download center on the left-side menu, locate your IDA product and base on your operating system, select an installer to download.
Now you are ready to install your IDA instance.
Go to My Hex-Rays portal. On the left menu, select a customer to see licenses assigned to it.
Navigate to Licenses -> Subscriptions. On the list, find the license ID and product for which you want to activate the license. Under Actions column, click on the three dots, and then in the dropdown menu, click Activate license.
Your product's license needs to be in a Pending activation status to activate. If you haven't done so before, you'll need to undergo the KYC procedure for paid products.
In the new dialog, assign the ownership of the license: set the MAC address of the machine where this IDA instance will be installed and running (it can be yours) and select decompilers. Optionally, select a Lumina and Teams server and tick the checkbox to send your license via email.
Click Assign button and then Click to confirm to finalize the assignment.
In the main subscriptions view, click on the three dots under Actions column, and in the dropdown menu, click Download license key to save it locally. You will need it to complete the installation process.
Navigate to the Download center on the left-side menu, locate your IDA product and base on your operating system, select an installer to download.
Now you are ready to install your IDA instance.
In this part, we cover the basics of license activation for floating license servers, Teams and Private Lumina servers, and the floating license server.
The Admin Guide covers the comprehensive manual regarding installation and server management.
The server installers and license files are available via My Hex-Rays portal.
Floating licenses are managed by administrators and require a license server to work. If you purchase the floating licenses, you will see an additional license for the license server in your Hex-Rays portal.
Similar to named and computer licenses, license server licenses need to be activated in the My Hex-Rays portal.
Go to My Hex-Rays portal. On the left menu, select a customer to see licenses assigned to it.
Navigate to Licenses -> Subscriptions. On the list, find the license server ID for which you want to activate the license. Under Actions column, click on the three dots, and then in the dropdown menu, click Activate license.
In the new dialog, assign the ownership to the license server and provide the MAC address of the device where the license server will be running.
Click Assign button and then Click to confirm to finalize the assignment.
In the main subscriptions view, click on the three dots under Actions column, and in the dropdown menu, click Download license key to save it locally. You will need it to complete the installation process.
Navigate to the Download center on the left-side menu, and select a license server installer to download.
Server installation for floating licenses should be done by the administrator. Check our Admin Guide for details.
Once your administrator installs a license server, adds particular license seats to the pool, and hands over the credentials, you are ready to install your IDA instance.
You don't need to download a license file/key to your local machine while using the floating licenses server.
Every time you launch IDA, you'll see the License Manager pop-up window. As long as there are free seats, you can borrow one of the available licenses and start using IDA.
Note that some of the available licenses may have different decompilers and add-ons enabled.
Each of our add-ons, Teams and Private Lumina, requires a separate server to work. The server license is provided with the first IDA instance/plan with the specific add-on enabled.
Similar to named/computer licenses and floating license server, the Teams server license needs to be activated in My Hex-Rays portal.
Server installation for Teams should be done by the administrator. Check our Admin Guide for details.
Similar to named/computer licenses and floating license server, the Private Lumina server license needs to be activated in the My Hex-Rays portal.
Server installation for Private Lumina should be done by the administrator. Check our Admin Guide for details.
In this submenu you can:
All IDA commands are available from the followings menus:
Load file
Execute a script command
Generate output file
Execute OS commands
Save database in packed form
Save database in packed form in another file
Take database snapshot
Abort - do not save changes
Quit to DOS - save changes
See also submenus.
Maksimize your IDA experience with trainigs tailored to all skill levels.
Explore the full collection of IDA Pro tutorial videos on our Hex-Rays channel.
Read in-depth manuals that cover every aspect of IDA.
Learn more about IDA with Igor's tip of the week and explore recent news from Hex-Rays.
This submenu allows you to load additional files into the database.
This command reloads the same input file into the database. IDA tries to retain as much information as possible in the database. All the names, comments, segmentation information and similar will be retained.
Only the values of individual bytes will be changed.
This command works for some input file types only: if the file was loaded into the database with special settings, this command may fail. In this case, use Dump database to IDC file command and reload the file manually.
See also Load... submenu commands.
This command loads a binary file. The new file is added to the current database and all existing information is retained.
The file content will appear as unexplored bytes in the program.
This command only allows you to load binary files.
See also Load... submenu commands.
This command loads an IDS file.
An IDS file contains information about well-known functions (such as functions from MS Windows API), namely:
IDS files are automatically loaded if they are found in the IDS directory. This command allows you to load an IDS file from any directory, even after the main file has been loaded into the database.
See also Load... submenu commands.
This command loads a DBG file.
If the program being disassembled has a companion DBG file, then this command may be used to load information from a DBG file into the database. IDA loads DBG files automatically if it can find them in the directory with the input file.
The built-in debug information loader cannot load NB10 format files and PDB files. To load those files, please use a special plugin, PDB.DLL, which can be run manually using Edit->Plugins submenu. This plugin uses MS Windows DLLs to load the debug information and therefore has the following limitations:
See also Load... submenu commands.
This command loads a PDB file.
If the program being disassembled has a companion PDB file, then this command may be used to load information from the PDB file into the database.
By default IDA uses in-house code to parse and load PDB files. However, our code can not parse old v2.0 PDB files. For them, IDA can fall back to using Microsoft DLLs (the default is "do not fall back"). Please read more in cfg/pdb.cfg.
Command line switch '-Opdb:option1:option2' overrides for ida session the value in cfg/pdb.cfg.
Ida will not load PDB plugin for this session.
This command loads a TDS file.
If the program being disassembled has a companion TDS file, this command may be used to load information from the TDS file into the database.
The TDS file must be placed in the same directory together with the input file.
The LoadTdsFile command launches a special plugin TDS.DLL which can be run manually using Edit->Plugins submenu.
See also Load... submenu commands.
This command allows you to apply an additional signature file to the program.
A signature file contains patterns of standard runtime functions. With their help, IDA is able to recognize the standard functions and names them accordingly.
IDA attempts to detect the necessary signature files automatically but unfortunately, this is not always possible. This command adds the specified signature file into the planned signature files queue.
Signature files reside in the subdirectories of the SIG directory. Each processor has its own subdirectory. The name of the subdirectory is equivalent to the name of the processor module file (z80 for z80.w32, for example). Note: IBM PC signatures are located in the SIG directory itself. Note: the IDASGN environment variable can be used to specify the location of the signatures directory.
There is another way to load a signature file: you may insert/delete signature files in the following way:
This is a preferred way of applying signatures because useful information, such as the number of identified functions is displayed in the signature window.
FLIRT works only for the processors with normal byte size. The byte size must be equal to 8 (processors with wide bytes like AVR or DSP56K are not supported)
See also Load... submenu commands.
This command allows you to apply type declarations from a C header file to the program.
IDA reads and parses the specified header file as a C compiler does. In other words, it mimics the front-end of a C compiler with some restrictions:
Don't forget to specify the compiler and memory model in the compiler setup dialog box before loading a header file.
All type declarations found in the input file are stored in the current database in the form of a type library. These type declarations can be used to define new structure and enumeration definitions by pressing "Add standard structure" or "Add standard enum" buttons in the Add enum type... and Add struct type... dialog boxes.
In the case of an error in the input file, the error messages appear in the message window. In any case, the function declarations that are already parsed are not deleted from the database. IDA stops parsing the input file when 20 errors occur.
IDA 7.7 introduced an alternative header file parser based on libclang.
See also
Load... submenu commands.
The IDAClang plugin is shipped with IDA, and it provides the ability to parse header files that contain arbitrarily complex C/C++/Objective-C source code using the Load C header action.
To enable the IDAClang parser, go to Options>Compiler>Source parser, and select "clang". Then use 'File>Load file>Parse C header file' to invoke the parser on a given source file.
Since IDAClang is based on the third-party libclang parser, it can only parse standalone source files that contain valid C/C++/Objective-C syntax.
See also Load C header command.
See also other File... submenu commands.
This submenu allows you to produce various output files. It also allows you to unload the database.
The text file-producing operations below will make use of
the currently-selected encoding for output files.
Please enter a file name for the map. IDA will write the following information about this file:
You may disable the generation of the segmentation information. You may also enable or disable dummy names in the output file.
You can use this map file for your information, and also for debugging (for example, Periscope from Periscope Company or Borland's Turbo Debugger can read this file).
Please enter a file name for the assembler text file. IDA will write the disassembled text to this file.
If you have selected a range on the screen using Drop Anchor command, IDA will write only the selected range (from the current address to the anchor).
If some I/O problem (e.g. disk full) occurs during writing to the file, IDA will stop and a partial file will be created.
Please enter a file name for the assembler include file. IDA will write the information about the defined types (structures and enums) to this file.
If some I/O problem (e.g. disk full) occurs during writing to the file, IDA will stop and a partial file will be created.
Enter a file name for the assembler listing file. IDA will write the disassembled text to this file.
If you've selected a range on the screen using Drop Anchor command, IDA will write only the selected range (from the current address to the anchor).
If some I/O problem (e.g. disk full) occurs during writing to the file, IDA will stop and a partial file will be created.
Enter a file name for the new executable file. Usually this command is used after patching (see commands Patch byte and Patch word) to obtain a patched version of the file.
IDA produces executable files only for:
For other file formats please create a difference file.
Only Patch byte/word commands affect the executable file contents, other commands (including User-Specified String for the #th Operand) will not affect the content of the disassembled file.
EXE files: Output files will have the same EXE-header and relocation table as the input file. IDA will fill unused ranges of the EXE file (e.g. between relocation table and loadable pages) with zeroes.
See also Edit|Patch core submenu.
This command will prompt you for a filename and then will create a plain text difference file of the following format:
See also Edit|Patch core submenu.
Please enter a file name for the HTML file. IDA will write the disassembled text to this file.
If you've selected a range on the screen using Drop Anchor command, IDA will write only the selected range (from the current address to the anchor).
If some I/O problem (e.g. disk full) occurs during writing to the file, IDA will stop and a partial file will be created.
This command is available only in the graphical version of IDA.
This command creates a GDL (graph description file) with the flow chart of the current function.
If there is an active selection, its flow chart will be generated.
IDA will ask for the output file name. Regardless of the specified extension, the .GDL extension will be used.
This command creates a GDL (graph description file) with the graph of the function calls.
IDA will ask for the output file name. Regardless of the specified extension, the .GDL extension will be used.
This command saves current IDA database into a text file.
You can use it as a safety command:
This command is used when you want to switch to a new version of IDA. Usually each new version of IDA has its own database format. To create a new format database, you need:
Please note that this command does not save everything to text file. Any information about the local variables will be lost!
This command saves all definitions in the local types window into a C header file.
This command saves information about the user-defined types from the IDA database into a text file.
Information about enums, structure types and other user-defined types is saved in a text form as an IDC program.
You can use this command to migrate the type definitions from one database to another.
See also other File... submenu commands.
You can enter and execute a small script written in the built-in IDC language or any other registered extlang.
Here is the list of built-in functions.
See also:
IDC language overview
Execute script file command
File... submenu commands
How to use notepad.
This command saves and packs the current database.
See also other File... submenu commands. Save database as... command.
This command takes a database snapshot. The snapshot can be later restored from the database snapshot manager.
Note: snapshots work only with regular databases. Unpacked databases do not support them.
See also View database snapshot manager commands.
By using this command, you can temporarily quit to the operating system.
This command is not available in the MS DOS version.
The database is left open when you use this command, so be careful.
See also commands.
This command terminates the current IDA session. The Abort command is not available if the database was not packed.
See also other File... submenu commands. Quit command.
This command terminates the current IDA session. IDA will write all changes to the disk and will close all databases.
You can enable/disable database packing. When the database is packed, it consists of one file with IDB extension. When the database is not packed, it consists of several files on the disk. If packing is disabled, in the next session you cannot abort IDA. We do not recommend to leave the database in the unpacked form because you will not have a backup copy.
You can also perform garbage collection on the database before packing it. The garbage collection removes the unused database pages, making it smaller. However, IDA needs some free database pages when it works,therefore it will allocate them again when you reuse the database. Removing and adding free pages takes time and, what is most important, it changes the database control blocks.
Use garbage collection only when you do not intend to work with the database in the near future.
IDA will remember all information about the screen, cursor position, jump stack, etc. The following information will be lost: keystroke macros, the anchor position To resume a disassembly session simply type: "ida file"
See also other File... submenu commands. Abort command.
In this document, we'll explore the essentials of IDA capabilities to kickstart your journey and disassemble your first binary file.
Your IDA instance is installed and running.
IDA natively recognizes plenty of file formats and processors.
If you later realize that's not enough, you can always use one of our community plugins that add additional formats or processor types or try to write your own with C++ SDK.
IDA stores the analysis results in the IDA Database files (called IDB), with the extension .i64
. This allows you to save your work and continue from the same point later. After loading a file at the beginning, IDA does not require access to the binary.
Any modifications you make are saved in the database and do not affect the original executable file.
Dive deeper
IDA provides decompilers designed to work with multiple processor architectures. The number of decompilers and their type (local or remote) available in your IDA instance depends on your chosen product and subscription plan and affects your ability to produce C-like pseudocode.
Check CrackMe, from where you can download executable files to test your reverse engineering skills.
When you launch IDA, you will see a Quick Start dialog that offers three ways to continue. For now, we'll focus on loading a new file and proceeding to disassembly results.
Launch IDA and in the Quick start dialog (1), click New.
Specify the path for your binary file.
In the Load a new file dialog (2), IDA presents loaders that are suited to deal with a selected file. Accepting the loader default selection and then the processor type is a good strategy for beginners. Click OK to confirm your selection.
IDA begins autoanalysis of your binary file.
After completion, you will be present with the default IDA desktop layout, that we'll describe in the next part.
Dive deeper
After autoanalysis is done, you'll see the main IDA desktop with the initial results. Let's examine the default desktop layout and commonly used UI elements.
Main menu bar (1)
Toolbar (2)
Navigation band (3)
Subviews (4)
Output (5)
Status bar (6)
The main menu bar provides quick access to essential features. Moreover, almost all menu commands can be quickly accessible via customizable shortcuts.
For a handy cheatsheet of all commands and their hotkeys, check Options -> Show command palette....
Dive deeper
Below the main menu bar, you will see a toolbar with icons that give you quick access to common functionalities (available also via the main menu/shortcuts). It has just one line by default, but you can customize it by adding or rearranging your actions.
Dive deeper
The navigation band shows the graphical representation of the analyzed binary file and gives a short overview of its contents and which areas may need your attention. The yellow arrow (indicator) shows where the cursor is currently positioned in the disassembly view.
As you'll soon recognize, the colors used in the nav band match those in other views.
Dive deeper
The output window is a place where various messages and logs are displaying, often descrybing what currently IDA is doing, like analyzing data or running a script. In the CLI box you can type commands in IDC language or IDAPython.
At the bottom left corner of the IDA window, you can see the status bar, which contains:
analysis indicator AU
, which shows the actual status of autoanalysis (1). In our case, it is idle
, which means the autoanalysis is already finished.
search direction indicator (2)
remaining free disk space (3)
Right-clicking on the status bar brings up a context menu that allows you to reanalyze the program.
Dive deeper
The subviews are one of the most prominent parts of your everyday work with IDA. These additional views (behaving like tabs) give a different perspective and information on the binary file, but the number of native IDA subviews may be a bit overwhelming. Here, we will focus on the most versatile and common subviews for beginners, where you'll spend most of the time, like:
IDA View
Pseudocode
Hex Dump View
Local Types
Functions View
When autoanalysis is done, you will see a graph view inside an IDA View by default. This flowchart graph should help you to understand the flow of the functions.
The graph view is available only for the part of the binary that IDA has recognized as functions.
IDA view has three modes:
graph view (1), that shows instructions grouped in blocks,
linear view (2), that lists all instructions and data in order of their addresses,
and proximity view (3), which allows you to see relations between functions, global variables, and other parts of the program.
Press Space
to switch between graph and linear mode. Provimity view is available from the context menu in IDA view.
Dive deeper
In hex view, you can see the raw bytes of the program's instructions.
There are two ways of highlighting the data in this view:
Text match highlight, which shows matches of the selected text anywhere in the views.
Current item highlight, which shows the bytes group constituting the current item.
The IDA view, pseudocode, and hex view can be synchronized, meaning that they highlight the same part of the analyzed program, and changes made inside one of the views are visible in the others.
Dive deeper
Generated by the famous F5
shortcut, the pseudocode shows the assembly language translated into human-readable, C-like pseudocode. Click Tab
to jump right into the Pseudocode view.
This view shows the high-level types used in databases, like structs or enums.
Dive deeper
This window displays all the functions recognized by IDA, along with key details for each:
Function name
Segment the segment that contains the function
Start: the function starting address
Length: the size of the function in bytes
Local: the amount of stack space taken by local variables
Arguments: the amount of stack space taken by arguments
By default, the entire window is not visible, so you may scroll horizontally to see the hidden elements. As you proably noticed, the colors in Functions window match the colors in navigation band; in our example, green higlightning shows functions recognized by Lumina.
This view is read-only, but you can automatically synchronize the function list with the IDA view, pseudocode, or hex view. Click to open the context menu and select Turn on synchronization.
Dive deeper
A crucial step in mastering IDA is learning how to navigate quickly to specific locations in the output. To help you get started, we'll cover essential commands and hotkeys commonly used for efficient navigation in IDA.
When you double-click on an item, such as a name or address, IDA automatically jumps to that location and relocate the display.
Go to Jump -> Jump to address.. or press G
hotkey
Enter the item name or hex address in the dialog box, then click OK.
To jump back to the previous position, press Esc
. To jump to the next position, press Ctrl + Enter
. You can also navigate using the arrows in the toolbar.
Position the cursor on a function or instruction, then go to Jump -> Jump to xref to operand... or press X
to see the dialog with listed all cross-references to this identifier.
Select an item from the list and click OK to jump to that location.
Dive deeper
Now that the initial autoanalysis is done and you’ve mastered the basics of navigation, it’s time to explore the basic interactive operations that reveal the true power of IDA in transforming your analysis.
One of the first steps you might take is to enhance readability by assigning meaningful names to local or global variables, but also functions, registers and other objects that IDA initially assigned a dummy name.
In the IDA View, right-click on the variable you want to rename and click Rename or press N
when the variable is cursor-highlighted.
In the newly opened dialog, insert a new name and click OK.
If at any point you want to go back to the original dummy name given by IDA, leave the field blank and click OK. It will reset the name to the default one.
Once you change the name, IDA will propagate the changes through the decompiler and Pseudocode view.
Dive deeper
Adding comments may be a useful way to annotate your work.
Highlight the line where you want to insert a comment and press :
.
In the dialog box, type your comment (you can use multiple lines) and click OK. This will add a regular (non-repeatable) comment to the location.
If you want to add a repeatable comment in every location that refers to the original comment, press ';'.
Dive deeper
Nearly every UI element is customizable, allowing you to rearrange and align widgets to suit your habits. You can save your personalized desktop layout by going to Windows -> Save desktop.
Most of the basic appearance you can change under Options menu.
To change the colors or theme, go to Options -> Colors.
To change the font, go to Options -> Fonts.
If you need more control over customization settings, you may check the IDA configuration files.
If you are ready to delve into dynamic analysis and start debugging your programs, here are some key steps to get you started:
Select the right debugger and complete the setup: Go to Debugger -> Select debugger... and pick up one of the avaliable debuggers. Under Debugger -> Debugger options, you can configure the setup in detail.
Add breakpoints: Right-click on the line where you want to stop the execution and select Add breakpoint from the context menu, or press F2
.
Start the process: Run the debuggin session by pressing F9
or click a green arrow on the tooltip.
Dive Deeper
One of the most common way of extanding IDA capabilities is to use on of our community-developed plugins.
You can find a variety of plugins in the official Hex-Rays plugin repository
For this guide purposes, we'll walk you through general installation steps.
The installation process can vary depending on the plugin and some of them may required installing dependencies or further configuration. Don't hesitate to refer to the specific instructions provided by the plugin author.
Copy your plugin folder to the plugins directory inside your IDA installation directory.
Alternatively, you can load the plugin from the command line in IDA by using File -> Script file... and selecting app.entry.py
file.
Navigate to Edit -> Plugins -> your_plugin_name or use the assigned hotkey.
You may need to restart IDA to see your plugin in the list.
Dive deeper
Here's a handy list of all of the shortcuts we used so far.
Space
Switches between graph and linear mode in the IDA View
F5
Generates pseudocode
Tab
Jumps into pseudocode View
G
Opens Jump to address dialog
Esc
Jumps back to the previous position
Ctrl + Enter
Jumps to the next position
X
Shows the list of all cross-references
N
Opens dialog to rename the current item
;
Adds repeatable comment
:
Adds regular comment
This submenu allows the user to modify text representation and to patch the file. It also has the commands to control the analysis:
This command reverts the database to the state before executing the last user action. It is possible to apply Undo multiple times, in this case multiple user actions will be reverted.
Since there is a limit on the size of undo buffers, any action, even the tiniest, may become non-undoable after some time. This is true because the analysis or plugins may continue to modify the database and overflow the buffers. Some massive actions, like deleting a segment, may be non-undoable just because of the sheer amount of undo data they generate.
Please note that Undo does not affect the state of IDC or Python scripts. Script variables will not change their values because of Undo. Also nothing external to the database can be changed: created files will not be deleted, etc.
Some actions cannot be undone. For example, launching a debugger or resuming from a breakpoint cannot be undone.
See also
This command also reverts all changes that were done to the database after the last Undo command, including the eventual useful modifications made by the autoanalysis. In other words, the entire database is modified to get to the exact state that it had before executing the last Undo command.
See also
This command completely disables the undo feature.
See also
This command converts the current unexplored bytes to instruction(s). IDA will warn you if it is not possible.
If you have selected a range using the [anchor](../../../disassembler/navigation/anchor.md, all the bytes from this range will be converted to instructions.
If you apply this command to an instruction, it will be reanalyzed.
This command clears the undo history. After it the Undo and Redo commands become unavailable. However, once the user performs a new action, IDA will again start journaling all database modifications.
A side effect of this command is fast autoanalysis: since there is no user action to revert yet, IDA does not maintain undo buffers and this speeds up the analysis.
See also
This command converts the current unexplored bytes to data. If it is not possible, IDA will warn you.
Multiple using of this command will change the data type:
Blog: Check what exactly IDB contains in Igor's tip of the week about IDA database.
Video: Watch different ways of loading files in our channel.
Docs: Check our User Guide for a comprehensive description of all menu items.
Video: Curious about practical ways to set up your toolbar? Watch our video tutorial.
Blog: A detailed navigation band overview with the full colors legend you can found in Igor's tip of the week.
Docs: To check all possible values and their meaning, take a look at analysis options.
Video: Check our video tutorial covering the basics of graph view.
Blog: Read the graph mode overview in Igor's tip of the week.
Video: Listen about hex view and others in our video tutorial.
Blog: Detailed overview of the hex view you can read in Igor's tip of the week.
Docs: Check our manual giving an overview of Local Types window.
Docs: Read the manual explaining all of the function window columns in detail.
Video: Watch our video tutorial exploring the funcions view.
Video: Explore the rest of the jump commands in our video tutorial
Docs: Check the details on renaming items in the User Guide
Video: Watch our step-by-step tutorial on renaming techniques.
Blog: Check Igor's tips of the week for expert advice on renaming.
Video: Watch our tutorial about commenting.
Docs: Read our User Guide for local and remote debugging manuals, or check step-by-step tutorials for specific debuggers.
Docs: Want to learn about writing your own plugins? Check our Developer Guide on how to create a plugin in IDAPython or with C++ SDK.
submenu
submenu
submenu
submenu
submenu
submenu
submenu
submenu
See also submenus.
Please note the entire database is reverted, including all modifications that were made to the database after executing the user action and including the ones that are not connected to the user action. For example, if a third party plugin modified the database during or after the user action, this modification will be reverted. In theory it is possible to go back in time to the very beginning and revert the database to the state state that was present immediately after performing the very first user action. However, in practice the undo buffers overflow because of the changes made by autoanalysis. generates copious amounts of undo data. Also please note that maintaining undo data during autoanalysis slows it down a bit. In practice it is not a big deal because the limit on the undo data is reached quite quickly (in a matter of minutes). Therefore, if during analysis the user does not perform any actions that modify the database, the undo feature will turn itself off temporarily.
However, if you prefer not to collect undo data at all during the initial autoanalysis, just turn off the UNDO_DURING_AA parameter in .
The configuration file has 2 more undo-related parameters:
This command reverts the previously issued command. It is possible to use Redo multiple times.
See also submenu
You may remove some items from this list using command.
If the does not support double words or another data type, it will be skipped. To create a structure variable, use command. To create an array, use command. To convert back, use command. See also submenu
The set of allowed characters is specified in the file, parameter StrlitChars. Character '\0' is not allowed in any case. If the current does not allow characters above 0x7F, characters with high bit set are not allowed.
If the has been dropped, IDA will take for the string all characters between the current cursor position and the anchor.
Use the if the string starts a disallowed character.
This command also generates a for the string. In the file, you can specify the characters allowed in names (NameChars).
You can change the literal string length using command.
To create Pascal style strings (with first byte indicating string length) use command.
See also submenu
This command allows you to create arrays and change their sizes.
The arrays are created in 2 simple steps:
Apply the array command to the created data item. Enter array size in current array elements (not bytes). The suggested array size is the minimum of the following values:
For string literals, you can use this command to change the length of the string.
The dialog box contains the following fields:
Items on a line (meaningless for string literals):
Please note that the margin parameter affects the number of items on a line too.
Alignment (meaningless for string literals):
If applied to a variable-sized structure, this command is used to specify the overall size of the structure. You cannot create arrays of variable-sized structures.
See also:
Edit submenu
This command deletes the current instruction or data, converting it to 'unexplored' bytes. IDA will delete the subsequent instructions if there are no more references to them (functions are never deleted).
If you have selected a range using the anchor, all the bytes in this range will be converted into 'unexplored' bytes. In this case, IDA will not delete any other instructions even if there are no references to them after the deletion.
See also Edit submenu
This command converts the immediate operand of the current instruction/data to an offset from the current data segment (DS).
If current DS value is unknown (or equal 0xFFFF) IDA will warn you -- it will beep. In this case, you have to define DS register value for the current byte. The best way to do it is:
If you want to delete offset definition, you can use this command again - it works as trigger.
If the cursor is on the first operand (the cursor is before ',') then the first operand will be affected; otherwise, all other operands will be affected.
See also:
This command converts the immediate operand of the current instruction/data to an offset from the current segment (CS).
If the cursor is on the first operand (the cursor is before ',') then the first operand will be affected; otherwise, all other operands will be affected.
See also:
This command converts the immediate operand of the current instruction/data to an offset from any segment.
IDA will ask to choose a base segment for the offset.
If the cursor is on the first operand (the cursor is before ',') then the first operand will be affected; otherwise, all other operands will be affected.
See also:
If the cursor is on the first operand (the cursor is before ',') then the first operand will be affected; otherwise, all other operands will be affected.
If the offset base is specified as 0xFFFFFFFF, then IDA will create "an automatic offset". Automatic offsets mean that the actual value of the base will be calculated by IDA.
The following offset attributes are available:
The offset base is dynamically calculated and is equal to the address of the current element:
for standalone items: their start address
for arrays: the start of the array element
See also:
This command permits to convert all immediate operands of instructions in a range selection to a path of offsets through a structure and its possible sub unions. If no selection is active, IDA will simply permit to convert the current operand. In this case, it will display a simple dialog box the same way as the text version (see below).
You can select the desired register in the drop-down list: all operands relative to this register will be added to the 'Offsets' list. A special empty line in the drop-down list is used to directly work on immediate values. Checkboxes in the 'Offsets' list allow you to select which operand you indeed want to modify. By default, IDA will select only undefined operands, to avoid overwriting previous type definitions. This list is sorted by operand value, by instruction address and finally by operand number. You can easily see the instructions related to the operand by moving the mouse over it, and wait for a hint to be displayed.
The 'Structures and Unions' tree will contain all selectable structures, and sub unions. Once you select or move over a structure, the 'Offsets' list updates itself for each checked offset: the computed name of the operand is displayed, according to the selected structure in the tree. An icon is also drawn, to easily know if a specific structure matchs the offset or not, or if the offset is too big for the selected structure. The structures who match the most offsets will be near the top of the tree. You can also move your mouse over structures in the tree to obtain an interesting hint.
A '?' icon can also appear, if the offset can be specialized by selecting an union member. In this case, if you expand the structure in the tree, you can select the adequate union member simply by checking the desired radio button. IDA automatically corrects the related name in the 'Offsets' list.
The 'Offset delta' value represents the difference between the structure start and the pointer value. For example, if you have an operand 4 and want to convert in into an expression like "mystruct.field_6-2", then you have to enter 2 as the delta. Usually the delta is zero, i.e. the pointer points to the start of the structure.
The 'Hide sub structures without sub unions' option (checked by default) avoids to add unnecessary sub structures to the tree, to keep it as small as possible. If you uncheck this option, all sub structures will be added to the tree.
First of all, IDA will ask a so-called "struct offset delta". This value represents the difference between the structure start and the pointer value. For example, if you have an operand 4 and want to convert in into an expression like "mystruct.field_6-2", then you have to enter 2 as the delta. Usually the delta is zero, i.e. the pointer points to the start of the structure.
If the cursor is on the first operand (the cursor is before ',') then the first operand will be affected; otherwise, all other operands will be affected.
See also:
or you can of DS for the current segment.
If a range is selected using the , IDA will perform 'en masse' conversion. It will convert immediate operands of all instructions in the selected range to offsets. However, IDA will ask you first the lower and upper limits of immediate operand value. If the operand value is >= lower limit and <= upper limit then the operand will be converted to offset, otherwise it will be left unmodified.
To create offsets to structure members use command.
command.
If a range is selected using the , IDA will perform 'en masse' conversion. It will convert immediate operands of all instructions in the selected range to offsets. However, IDA will ask you first the lower and upper limits of immediate operand value. If the operand value is >= lower limit and <= upper limit then the operand will be converted to offset, otherwise, it will be left unmodified.
If this command is applied to a structure member in the , then IDA will create an "automatic offset". An automatic offset is an offset with the base equal to 0xFFFFFFFF. This base value means that the actual value of the base will be calculated by IDA when a structure instance is created.
To create offsets to structure members, use command.
commands.
If a range is selected using the , IDA will perform 'en masse' conversion. It will convert immediate operands of all instructions in the selected range to offsets. However, IDA will ask you first the lower and upper limits of immediate operand value. If the operand value is >= lower limit and <= upper limit then the operand will be converted to offset, otherwise it will be left unmodified.
To create offsets to structure members use command.
commands.
for structures: the start of the structure field The offset expression is displayed in the following concise form: offset target - $ where "$" denotes the start of the element (and is -dependent). To create offsets to structure members use command.
commands.
By default, IDA displays the structure member at offset 0. To change this behaviour, you can directly disable the 'Force zero offset field' in the 'Options' frame. Later zero offsets can be forced using menu item.
This command converts immediate operand(s) type of the current instruction/data to an offset within the specified structure. Before using this command, you have to a structure type.
If a range is selected using the , IDA will perform 'en masse' conversion. It will convert immediate operands of all instructions in the selected range to offsets. However, IDA will ask you first the lower and upper limits of immediate operand value. If the an operand value is >= lower limit and <= upper limit then the operand will be converted to offset, otherwise it will be left unmodified.
When you use this command, IDA deletes the entered operand.
By default IDA doesn't display the structure member at offset 0. To change this behaviour, use command.
Moreover, if there are several possible representations (this can happen if unions are used), select the desired representation using the command.
command.
Related topics: submenu.
This submenu allows you to change the operand types to offsets, numbers, chars, etc. Use it to make disassembled text more understandable.
If IDA suspects that an operand can be represented as something different from a plain number, it will mark the operand as "suspicious" and show it in red. Use these commands to delete suspicious marks.
Some of these commands can be applied to a selected range. Click here to learn about the rules applied to such operations.
See also Edit submenu.
This command converts immediate operand(s) type of the current instruction/data to a number. That way, you can delete suspicious mark of the item.
The number is represented in the default radix for the current processor (usually hex, but octal for PDP-11, for example).
When you use this command, IDA deletes the manually entered operand.
If the cursor is on the first operand (the cursor is before ',') then the first operand will be affected; otherwise, all other operands will be affected.
This command converts immediate operand(s) type of the current instruction/data to hex number. So you can delete suspicious mark of the item.
When you use this command, IDA deletes the manually entered operand.
If the cursor is on the first operand (the cursor is before ',') then the first operand will be affected; otherwise, all other operands will be affected.
This command converts the immediate operand(s) type of the current instruction/data to decimal. Therefore, it becomes a 'number'.
When you use this command, IDA deletes the manually entered operand.
If the cursor is on the first operand (the cursor is before ',') then the first operand will be affected; otherwise, all other operands will be affected.
This command makes the current instruction or data operand type octal. IDA always uses 123o notation for octal numbers even if the current assembler does not support octal numbers.
When you use this command, IDA deletes the manually entered operand.
If the cursor is on the first operand (the cursor is before ',') then the first operand will be affected; otherwise, all other operands will be affected.
This command makes the current instruction or data operand type binary. IDA always uses 123b notation for binary numbers even if the current assembler does not support binary numbers.
When you use this command, IDA deletes the manually entered operand.
If the cursor is on the first operand (the cursor is before ',') then the first operand will be affected; otherwise, all other operands will be affected.
This command makes the current operand type floating point.
When you use this command, IDA deletes the manually entered operand.
If the cursor is on the first operand (the cursor is before ',') then the first operand will be affected; otherwise, all other operands will be affected.
This command displays or hides the leading zeroes of the current operand. Example: if the instruction looked like this:
then after applying the command it will look like this:
If you prefer to see leading zeroes in all cases, then open the calculator and enter the following expression: set_inf_attr(INF_GENFLAGS, get_inf_attr(INF_GENFLAGS) | INFFL_LZERO); This will toggle the default for the current database and all numbers without leading zeroes will become numbers with leading zeroes, and vice versa.
See also Edit|Operand types submenu.
This command gives name/renames/deletes name for the current item.
To delete a name, simply give an empty name.
If the current item is referenced, you cannot delete its name. Even if you try, IDA will generate a dummy name.
Local name
Include in name list
Here you can also include/remove the name from the
name list
. If the name is hidden, you will not see it in
names window
.
Public name
Autogenerated name
Weak name
Create name anyway
See also Edit submenu. How to Enter an Identifier. Names representation.
This command converts immediate operand(s) type of the current instruction to an offset to stack variables, i.e. a local variable or function argument in the stack.
You need to define stack variables before using this command.
If the current operand is based on the value of the stack pointer ([ESP+xxx]) and the SP value is traced incorrectly, then you need to correct SP value using change stack pointer command.
If a range is selected using the anchor, IDA will perform 'en masse' conversion. It will convert immediate operands of all instructions in the selected range to stack variables. However, IDA will ask you first the lower and upper limits of immediate operand value. If the operand value is >= lower limit and <= upper limit then the operand will be converted to stack variable, otherwise it will be left unmodified.
When you use this command, IDA deletes the manually entered operand.
If the cursor is on the first operand (the cursor is before ',') then the first operand will be affected; otherwise all other operands will be affected.
See also: Edit|Operand types submenu. Enter #th operand manually commands. Define stack variables...
This command converts immediate operand(s) type of the current instruction/data to character.
If the cursor is on the first operand (the cursor is before ',') then the first operand will be affected; otherwise, all other operands will be affected.
If the selected enum is a bitfield, IDA will try to build a bitfield expression to represent the constant. Please note that for bitfields having multiple constants with the same value some expressions won't be possible.
If the cursor is on the first operand (the cursor is before ',') then the first operand will be affected; otherwise all other operands will be affected.
This command converts the immediate operand(s) type of the current instruction/data to segment base. The segment bases are usually displayed like this:
If IDA cannot find a segment whose base is equal to the operand value, it simply displays it as hex number.
If the cursor is on the first operand (the cursor is before ',') then the first operand will be affected; otherwise, all other operands will be affected.
A complex offset expression looks like
It is specified by:
The relationship between these parameters is (the formula is given for full offsets):
You always have to specify the offset type and base. Usually, the delta is equal to zero. For the full offset type you may omit the offset target, which is recommended. In this case, IDA will calculate it automatically. However, if you specify the offset target, make sure that the relationship between the parameters still holds. For the half offset types, you have to specify the target because there is no way to calculate it.
The offset types:
When you use this command, IDA deletes the entered operand.
See also submenu.
This command converts immediate operand(s) type of the current instruction/data to an enum member. Before using this command, you have to an enumeration type.
If a range is selected using the , IDA will perform 'en masse' conversion. It will convert immediate operands of all instructions in the selected range to symbolic constants. However, IDA will ask you first the lower and upper limits of immediate operand value. If the operand value is >= lower limit and <= upper limit then the operand will be converted to offset, otherwise it will be left unmodified.
When you use this command, IDA deletes the entered operand.
See also: submenu. commands.
When you use this command, IDA deletes the entered operand.
See also submenu.
See also
This command changes the sign of the current operand. Please note that not all operands can change their sign.
See also: Edit|Operand types submenu. Enter #th operand manually commands. Set operand type
This command bit-wisely negates the current operand. Please note that not all types of operands can be negated. It is not possible to negate and change sign of an operand simultaneously.
This command works only if the current assembler supports the bitwise negation operation.
See also: Edit|Operand types submenu. Enter #th operand manually commands. Set operand type
This command allows you to specify the type of the operand under the cursor.
The operand type must be entered as a C declaration. Currently IDA itself does not use the operand type information. However, it can be used by the Hex-Rays decompiler plugin. Setting operand type is most useful in case of indirect calls: the decompiler will use the type information to determine the input parameters to the call instead of guessing, which can make the decompiled code better.
An example of a type declaration:
To delete a type declaration, enter an empty string.
For details on possible calling conventions, see Set function/item type... menu item description.
See also Set function/item type...
This submenu allows you to manipulate different kinds of comments. Use them to make the disassembled text more understandable.
If you stand at the function start and your cursor is on a function name, IDA will ask you to enter a function comment.
If you stand at the segment start and your cursor is on a segment name, IDA will ask you to enter a segment comment.
If this command is issued in the local types window, it allows you to change the comment of a structure/enum, or structure/enum member. If the cursor is on the structure/enum name, the structure/enum comment will be changed, otherwise the member comment will be changed.
Otherwise, this command allows you to enter a normal indented comment for the current item.
You can show/hide all comments in Comments Dialog.
See also
How to use the notepad
Edit|Comments submenu, Repeatable comments
This command allows you to enter a repeatable comment. A repeatable comment will appear attached to the current item and all other items referencing it.
If you stand at the function start, IDA will ask you to enter a function comment.
If this command is issued in the local types window, it allows you to change the comment of a structure/enum, or structure/enum member. If the cursor is on the structure/enum name, the structure/enum comment will be changed, otherwise the member comment will be changed.
Otherwise, this command allows you to enter a repeatable comment for the current item.
You cannot enter repeatable segment comments.
All items that refer to the current item will have this comment by default.
Note that if you have defined both comment types (regular and repeatable), the regular comment will be displayed for the current item and the repeatable comment will be displayed for all items that refer to the current item, if they do not have their own comments.
The repeatable comments may be used to describe subroutines, data items, etc., because all calls to the subroutine will have the repeatable comment.
You can show/hide all comments in the Comments Dialog.
You can show and hide repeatable comments in the Comments Dialog.
See also "How to use the notepad".
If you want to enter multi-line comments or additional instructions, you can use this feature of IDA.
There are two kinds of extra lines: the ones generated before the instruction line and the ones generated after the instruction line.
Do not forget that the maximal number of lines for an item is 500.
IDA does not insert a comment symbol at the beginning of the lines.
See also "How to use the notepad".
Related topics: Edit submenu.
You may specify any string instead of an operand if IDA does not represent the operand in the desired form. In this case, IDA will simply display the specified string in the instruction instead of the default operand.
The current operand (under the cursor) will be affected.
You can use this command not only with instructions but with data items too.
IDA proposes the previous manual operand as the default value in the input form.
To delete the manual operand and revert back to the default text, specify an empty string.
IDA automatically deletes manually entered operands when you change operand representation using operand types submenu.
NOTE: A text offset reference is generated if you use a label in the program as the operand string. In other cases no cross-references are generated.
See also Edit|Operand types submenu.