With IDA 9.0, we changed how the Hex-Rays documentation is organized and added new guides and tutorials to kickstart your IDA journey and ease the migration from previous IDA versions.

New Structure

Our docs are divided into three main categories:

• User Guide, dedicated to individual users and covering whole IDA products (including add-ons, like Teams and Lumina). Most of the documentation regarding IDA, like manuals or tutorials, is currently accessible under the User Guide.

• Developer Guide, which focuses on developer's needs, covers the reference and contextual documentation for IDAPython API and C++ SDK, as well as native IDC language. This part is mainly dedicated to plugin authors and devs interested in enhancing basic IDA capabilities with our development kit or scripting.

• Admin Guide mainly focuses on administrators installing and managing servers for Teams and Lumina or floating licenses.

In Archive, we gathered docs with rather historical value that some of you may still find interesting but focused on previous versions of IDA.

New Getting Started Guides

We prepared a Getting Started section for IDA newbies and also gathered additional materials to help you find your way around our IDAPython API or IDA SDK.

Migration and Porting Guides

For those familiar with previous versions of IDA, we prepared Porting Guides for IDAPython and C++ SDK. If you use the Flexera server for floating licenses, check our Migration Guide for new Hex-Rays license server.

Basic Usage

In this document, we'll explore the essentials of IDA capabilities to kickstart your journey and disassemble your first binary file.

Prerequisites

Your IDA instance is installed and running.

Before you begin

What files and processors are supported?

IDA natively recognizes plenty of file formats and processors.

If you later realize that's not enough, you can always use one of our community plugins that add additional formats or processor types or try to write your own with C++ SDK.

What are IDA database files?

IDA stores the analysis results in the IDA Database files (called IDB), with the extension .i64. This allows you to save your work and continue from the same point later. After loading a file at the beginning, IDA does not require access to the binary.

Any modifications you make are saved in the database and do not affect the original executable file.

Dive deeper

What decompilers can I work with?

IDA provides decompilers designed to work with multiple processor architectures. The number of decompilers and their type (local or remote) available in your IDA instance depends on your chosen product and subscription plan and affects your ability to produce C-like pseudocode.

Where can I find exemplary binaries to work with?

Check CrackMe, from where you can download executable files to test your reverse engineering skills.

Part 1: Loading your file

When you launch IDA, you will see a Quick Start dialog that offers three ways to continue. For now, we'll focus on loading a new file and proceeding to disassembly results.

1. Launch IDA and in the Quick start dialog (1), click New.

2. Specify the path for your binary file.

3. In the Load a new file dialog (2), IDA presents loaders that are suited to deal with a selected file. Accepting the loader default selection and then the processor type is a good strategy for beginners. Click OK to confirm your selection.

1. IDA begins autoanalysis of your binary file.

After completion, you will be present with the default IDA desktop layout, that we'll describe in the next part.

Dive deeper

Part 2: UI overview

After autoanalysis is done, you'll see the main IDA desktop with the initial results. Let's examine the default desktop layout and commonly used UI elements.

1. Main menu bar (1)

2. Toolbar (2)

3. Navigation band (3)

4. Subviews (4)

5. Output (5)

6. Status bar (6)

Main menu bar

The main menu bar provides quick access to essential features. Moreover, almost all menu commands can be quickly accessible via customizable shortcuts.

For a handy cheatsheet of all commands and their hotkeys, check Options -> Show command palette....

Dive deeper

Toolbar

Below the main menu bar, you will see a toolbar with icons that give you quick access to common functionalities (available also via the main menu/shortcuts). It has just one line by default, but you can customize it by adding or rearranging your actions.

Dive deeper

Navigation band

The navigation band shows the graphical representation of the analyzed binary file and gives a short overview of its contents and which areas may need your attention. The yellow arrow (indicator) shows where the cursor is currently positioned in the disassembly view.

As you'll soon recognize, the colors used in the nav band match those in other views.

Dive deeper

Output

The output window is a place where various messages and logs are displaying, often descrybing what currently IDA is doing, like analyzing data or running a script. In the CLI box you can type commands in IDC language or IDAPython.

Status bar

At the bottom left corner of the IDA window, you can see the status bar, which contains:

• analysis indicator AU, which shows the actual status of autoanalysis (1). In our case, it is idle, which means the autoanalysis is already finished.

• search direction indicator (2)

• remaining free disk space (3)

Right-clicking on the status bar brings up a context menu that allows you to reanalyze the program.

Dive deeper

Subviews

The subviews are one of the most prominent parts of your everyday work with IDA. These additional views (behaving like tabs) give a different perspective and information on the binary file, but the number of native IDA subviews may be a bit overwhelming. Here, we will focus on the most versatile and common subviews for beginners, where you'll spend most of the time, like:

• IDA View

• Pseudocode

• Hex Dump View

• Local Types

• Functions View

IDA View / Disassembly Window

When autoanalysis is done, you will see a graph view inside an IDA View by default. This flowchart graph should help you to understand the flow of the functions.

IDA view has three modes:

• graph view (1), that shows instructions grouped in blocks,

• linear view (2), that lists all instructions and data in order of their addresses,

• and proximity view (3), which allows you to see relations between functions, global variables, and other parts of the program.

Dive deeper

Hex View Window

In hex view, you can see the raw bytes of the program's instructions.

There are two ways of highlighting the data in this view:

1. Text match highlight, which shows matches of the selected text anywhere in the views.

2. Current item highlight, which shows the bytes group constituting the current item.

Dive deeper

Pseudocode Window

Generated by the famous F5 shortcut, the pseudocode shows the assembly language translated into human-readable, C-like pseudocode. Click Tab to jump right into the Pseudocode view.

Local Types Window

This view shows the high-level types used in databases, like structs or enums.

Dive deeper

Functions Window

This window displays all the functions recognized by IDA, along with key details for each:

• Function name

• Segment the segment that contains the function

• Start: the function starting address

• Length: the size of the function in bytes

• Local: the amount of stack space taken by local variables

• Arguments: the amount of stack space taken by arguments

By default, the entire window is not visible, so you may scroll horizontally to see the hidden elements. As you proably noticed, the colors in Functions window match the colors in navigation band; in our example, green higlightning shows functions recognized by Lumina.

This view is read-only, but you can automatically synchronize the function list with the IDA view, pseudocode, or hex view. Click to open the context menu and select Turn on synchronization.

Dive deeper

Part 3: Basic navigation

A crucial step in mastering IDA is learning how to navigate quickly to specific locations in the output. To help you get started, we'll cover essential commands and hotkeys commonly used for efficient navigation in IDA.

Double-click and jump to the location

When you double-click on an item, such as a name or address, IDA automatically jumps to that location and relocate the display.

Jump to address

1. Go to Jump -> Jump to address.. or press G hotkey

2. Enter the item name or hex address in the dialog box, then click OK.

To jump back to the previous position, press Esc. To jump to the next position, press Ctrl + Enter. You can also navigate using the arrows in the toolbar.

See the list of cross-references

1. Position the cursor on a function or instruction, then go to Jump -> Jump to xref to operand... or press X to see the dialog with listed all cross-references to this identifier.

2. Select an item from the list and click OK to jump to that location.

Dive deeper

Part 4: Manipulate your disassembly results

Now that the initial autoanalysis is done and you’ve mastered the basics of navigation, it’s time to explore the basic interactive operations that reveal the true power of IDA in transforming your analysis.

Rename a stack variable

One of the first steps you might take is to enhance readability by assigning meaningful names to local or global variables, but also functions, registers and other objects that IDA initially assigned a dummy name.

1. In the IDA View, right-click on the variable you want to rename and click Rename or press N when the variable is cursor-highlighted.

2. In the newly opened dialog, insert a new name and click OK.

If at any point you want to go back to the original dummy name given by IDA, leave the field blank and click OK. It will reset the name to the default one.

Dive deeper

Add a comment

Adding comments may be a useful way to annotate your work.

1. Highlight the line where you want to insert a comment and press :.

2. In the dialog box, type your comment (you can use multiple lines) and click OK. This will add a regular (non-repeatable) comment to the location.

Dive deeper

Part 5: Customizing IDA

Nearly every UI element is customizable, allowing you to rearrange and align widgets to suit your habits. You can save your personalized desktop layout by going to Windows -> Save desktop.

Most of the basic appearance you can change under Options menu.

• To change the colors or theme, go to Options -> Colors.

• To change the font, go to Options -> Fonts.

If you need more control over customization settings, you may check the IDA configuration files.

Part 6: Debug your file

If you are ready to delve into dynamic analysis and start debugging your programs, here are some key steps to get you started:

1. Select the right debugger and complete the setup: Go to Debugger -> Select debugger... and pick up one of the avaliable debuggers. Under Debugger -> Debugger options, you can configure the setup in detail.

2. Add breakpoints: Right-click on the line where you want to stop the execution and select Add breakpoint from the context menu, or press F2.

3. Start the process: Run the debuggin session by pressing F9 or click a green arrow on the tooltip.

Dive Deeper

Part 7: Install a plugin

One of the most common way of extanding IDA capabilities is to use on of our community-developed plugins.

Where can I find IDA plugins?

You can find a variety of plugins in the official Hex-Rays plugin repository

Installing your plugin

For this guide purposes, we'll walk you through general installation steps.

Load your plugin

1. Copy your plugin folder to the plugins directory inside your IDA installation directory.

2. Alternatively, you can load the plugin from the command line in IDA by using File -> Script file... and selecting app.entry.py file.

Run your plugin

1. Navigate to Edit -> Plugins -> your_plugin_name or use the assigned hotkey.

Dive deeper

Key hotkeys cheatsheet

Here's a handy list of all of the shortcuts we used so far.

• Space Switches between graph and linear mode in the IDA View

• F5 Generates pseudocode

• Tab Jumps into pseudocode View

• G Opens Jump to address dialog

• Esc Jumps back to the previous position

• Ctrl + Enter Jumps to the next position

• X Shows the list of all cross-references

• N Opens dialog to rename the current item

• ; Adds repeatable comment

• : Adds regular comment

Discover the core of Hex-Rays guides and manuals, guiding you through IDA features and real-life usage scenarios.

Getting Started

New to IDA? Explore our selection of documentation to guide you through the installation process and jumpstart your reverse engineering journey.

Our Guides

Delve into detailed guides to discover IDA features and maximize its capabilities.

By following the steps in this guide, you can successfully install your IDA instance on macOS, Linux, and Windows.

The installation steps are valid for all product versions: IDA Pro, IDA Home, or IDA Free (except license registration).

This installation guide is dedicated to individual users.

Minimum system requirements

Pre-installation steps

Activate your named or computer license via My Hex-Rays portal.

Installation on macOS

Prerequisites:

• Ensure that you have activated your computer/named license and downloaded your license file (ida.hexlic) locally.

• Make sure Python 3 or later is installed on your computer for the IDAPython API to function properly.

Step 1: Download the installer

• Download the macOS version of IDA Pro from Download Center in My Hex-Rays portal.

Step 2: Run the installer

• Extract the .zip archive.

• Double-click on the extracted file to run the instalation wizard.

• Follow the wizard's instructions to complete the installation:

  • accept the license agreement and installation directory;

  • copy your ida.hexlic file to IDA installation directory or to $HOME/.idapro directory before launching IDA.

Step 4: Launch IDA Pro for the first time

• Double-click on the IDA Pro icon to launch the application.

Step 5: Point to your named/computer license

• In the License manager pop-up window, specify the path of your license file and click OK.

Installation on Linux

Prerequisites:

• Ensure that you have activated your computer/named license and downloaded your license file (ida.hexlic) locally.

• Make sure Python 3 or later is installed on your computer for the IDAPython API to function properly.

• Verify that you have the required libraries installed. Use your package manager to install any missing dependencies. Common dependencies include libx11, libxext, libxrender, and libglib2.0.

Step 1: Download the installer

• Download the Linux version of IDA Pro from Download Center in My Hex-Rays portal.

Step 4: Run the installer

• Navigate to the directory containing your IDA installer, and make it executable.

• Run the installer by double-click it or enter ./<your_IDA_version_>linux.run in the terminal to execute it.

• Follow the wizard's instructions to complete the installation:

  • accept the license agreement and installation directory;

  • copy your ida.hexlic file to IDA installation directory or to $HOME/.idapro directory before launching IDA.

Step 5: Launch IDA Pro for the first time

• Go to the directory where IDA is installad and run the command: ./ida90

Step 6: Point to your named/computer license

• In the License manager pop-up window, specify the path of your license file and click OK.

Installation on Windows

• Ensure that you have activated your computer/named license and downloaded your license file (ida.hexlic) locally.

• Make sure Python 3 or later is installed on your computer for the IDAPython API to function properly.

Step 1: Download the installer

• Download the Windows version of IDA Pro from Download Center in My Hex-Rays portal .

Step 2: Run the installer

• Locate the downloaded .exe file and double-click it to run the installer.

• Follow the installation wizard's instructions to complete the installation:

  • accept the license agreement and installation directory;

  • copy your ida.hexlic file to IDA installation directory or to %APPDATA%/Hex-Rays/IDA Pro directory before launching IDA.

Step 5: Launch IDA Pro for the first time

• Navigate to the Start Menu or desktop shortcut and launch IDA Pro.

Step 6: Point to your named/computer license

• In the License Manager pop-up window, specify the path of your license file and click OK.

Use floating license server

Step 1: In the License manager pop-up window, select the option Use floating license server and then type a license server hostname provided by your administrator.

Step 2: Borrow one of the licenses visible under the available licenses list and click OK.

Note that you don't need a license file stored on your machine locally while using floating licenses.

Common Post-Installation Steps

Step 1: Update IDA Pro

• After installation, check for any available updates. Hex-Rays often releases patches and updates for IDA Pro. You can check for updates within the application via Help -> Check for free update or download the latest version from My Hex-Rays portal.

Step 2: Configure environment (optional)

• Customize your IDA Pro environment settings to suit your preferences. This can include configuring hotkeys, and adjusting appearance settings.

Step 3: Install additional plugins (optional)

• You can extend the functionality of IDA Pro by installing additional plugins that can be found on the official Hex-Rays website or other trusted sources in the reverse engineering community.

All IDA commands are available from the followings menus:

• File

• Edit

• Jump

• Search

• View

• Debugger

• Lumina

• Options

• Windows

 Action    name: ExecuteLine
 

You can enter and execute a small script written in the built-in IDC language or any other registered extlang.

Here is the list of built-in functions.

See also:

• IDC language overview

• Execute script file command

• File... submenu commands

• How to use notepad.

In this submenu you can:

• Load file Load file

• Script command Execute a script command

• Produce output file Generate output file

• OS shell Execute OS commands

• Save database Save database in packed form

• Save database as... Save database in packed form in another file

• Take database snapshot Take database snapshot

• Abort Abort - do not save changes

• Quit Quit to DOS - save changes

See also Menu Bar submenus.

This submenu allows you to load additional files into the database.

• Reload input file

• Script file

• Binary file

• IDS file

• Debug information file

• PDB debug information file

• TDS debug information file

• FLIRT signature file

• C header file

Reload the input file

Action    name: ReloadFile

This command reloads the same input file into the database. IDA tries to retain as much information as possible in the database. All the names, comments, segmentation information and similar will be retained.

Only the values of individual bytes will be changed.

This command works for some input file types only: if the file was loaded into the database with special settings, this command may fail. In this case, use Dump database to IDC file command and reload the file manually.

See also Load... submenu commands.

Load additional file

 Action    name: LoadFile
 

This command loads a binary file. The new file is added to the current database and all existing information is retained.

The file content will appear as unexplored bytes in the program.

This command only allows you to load binary files.

See also Load... submenu commands.

Load IDS file

 Action    name: LoadIdsFile
 

This command loads an IDS file.

An IDS file contains information about well-known functions (such as functions from MS Windows API), namely:

        - their names
        - their ordinal number in the DLL
        - an eventual informative comment
        - the number of parameters passed on the stack
        - the number of parameters purged when returning

IDS files are automatically loaded if they are found in the IDS directory. This command allows you to load an IDS file from any directory, even after the main file has been loaded into the database.

See also Load... submenu commands.

Load debug information file

 Action    name: LoadDbgFile
 

This command loads a DBG file.

If the program being disassembled has a companion DBG file, then this command may be used to load information from a DBG file into the database. IDA loads DBG files automatically if it can find them in the directory with the input file.

The built-in debug information loader cannot load NB10 format files and PDB files. To load those files, please use a special plugin, PDB.DLL, which can be run manually using Edit->Plugins submenu. This plugin uses MS Windows DLLs to load the debug information and therefore has the following limitations:

        - it works only under MS Windows
        - it will load only PDBs compatible with the currently
          installed IMAGEHLP.DLL

See also Load... submenu commands.

Load PDB debug information file

 Action    name: LoadPdbFile
 

This command loads a PDB file.

If the program being disassembled has a companion PDB file, then this command may be used to load information from the PDB file into the database.

By default IDA uses in-house code to parse and load PDB files. However, our code can not parse old v2.0 PDB files. For them, IDA can fall back to using Microsoft DLLs (the default is "do not fall back"). Please read more in cfg/pdb.cfg.

Command line switch '-Opdb:option1:option2' overrides for ida session the value in cfg/pdb.cfg.

List of options

  off    : disable PDB
  pdbida : uses Hex-rays in-house code to parse and load PDB files.
  msdia  : uses Microsoft DLLs to parse and load PDB files.
           only available on Windows, for Linux/Macos you need to configure
           win32_remote.exe or win64_remote64.exe server in cfg/pdb.cfg
  fallback   : fallback from pdbida to msdia for the old 2.0 format
  nofallback : no fallback to msdia

Example

  -Opdb:off

Ida will not load PDB plugin for this session.

Load TDS debug information file

 Action    name: LoadTdsFile
 

This command loads a TDS file.

If the program being disassembled has a companion TDS file, this command may be used to load information from the TDS file into the database.

The TDS file must be placed in the same directory together with the input file.

The LoadTdsFile command launches a special plugin TDS.DLL which can be run manually using Edit->Plugins submenu.

See also Load... submenu commands.

Load FLIRT signature file

 Action    name: LoadSigFile
 

This command allows you to apply an additional signature file to the program.

A signature file contains patterns of standard runtime functions. With their help, IDA is able to recognize the standard functions and names them accordingly.

IDA attempts to detect the necessary signature files automatically but unfortunately, this is not always possible. This command adds the specified signature file into the planned signature files queue.

Signature files reside in the subdirectories of the SIG directory. Each processor has its own subdirectory. The name of the subdirectory is equivalent to the name of the processor module file (z80 for z80.w32, for example). Note: IBM PC signatures are located in the SIG directory itself. Note: the IDASGN environment variable can be used to specify the location of the signatures directory.

There is another way to load a signature file: you may insert/delete signature files in the following way:

        - open the signatures window
        - press Ins to insert a signature file to the queue
        - press Del to delete a signature file from the queue

This is a preferred way of applying signatures because useful information, such as the number of identified functions is displayed in the signature window.

See also Load... submenu commands.

Load C header

 Action    name: LoadHeaderFile
 

This command allows you to apply type declarations from a C header file to the program.

IDA reads and parses the specified header file as a C compiler does. In other words, it mimics the front-end of a C compiler with some restrictions:

        - only type declarations are allowed. The function definitions
          in the input file are skipped
        - not all C++ header files are not supported, only simple classes can
          be parsed
        - the compiler specific predefined macros are not defined,
          you have to define them manually in the header file

Don't forget to specify the compiler and memory model in the compiler setup dialog box before loading a header file.

All type declarations found in the input file are stored in the current database in the form of a type library. These type declarations can be used to define new structure and enumeration definitions by pressing "Add standard structure" or "Add standard enum" buttons in the Add enum type... and Add struct type... dialog boxes.

In the case of an error in the input file, the error messages appear in the message window. In any case, the function declarations that are already parsed are not deleted from the database. IDA stops parsing the input file when 20 errors occur.

IDA 7.7 introduced an alternative header file parser based on libclang.

See also

• Load... submenu commands.

• Local types window

• IDAClang plugin

IDAClang plugin

The IDAClang plugin is shipped with IDA, and it provides the ability to parse header files that contain arbitrarily complex C/C++/Objective-C source code using the Load C header action.

To enable the IDAClang parser, go to Options>Compiler>Source parser, and select "clang". Then use 'File>Load file>Parse C header file' to invoke the parser on a given source file.

Since IDAClang is based on the third-party libclang parser, it can only parse standalone source files that contain valid C/C++/Objective-C syntax.

See also Load C header command.

See also other File... submenu commands.

In this document, we covered the basics regarding our licensing model: you can check how to activate your license depending on the license type, what to do with the downloaded license files, and how to finalize license settings while running IDA. This guide is dedicated to individual users.

Licenses overview

License types

In Hex-Rays, we offer two basic license types for IDA products, that are suitable for individual users:

• Named licenses, that are assigned to specific individuals.

• Computer licenses that are assigned to specific devices.

There is also an additional type, called floating licenses, that allow a set number of concurrent users but are not assigned to specific individuals or devices.

What are license files, and where can I find them?

The license file contains your license ID and other data and is required to make your IDA instance fully operative after installation.

You can download your license file from My Hex-Rays portal, after its activation.

License Activation

To complete the installation, you need an active IDA license with an assigned owner or a MAC address. Without activation, you cannot download your license file.

What is needed to assign my license?

• for named licenses: the email address of the owner,

• for computer licenses: the MAC address of a specific device

• for floating licenses: the MAC address of the device where the license server will be running

Named licenses activation

1. Go to My Hex-Rays portal. On the left menu, select a customer to see licenses assigned to it.

1. Navigate to Licenses -> Subscriptions. On the list, find the license ID and product for which you want to activate the license. Under Actions column, click on the three dots, and then in the dropdown menu, click Activate license.

1. In the new dialog, assign the ownership of the license: set the email address for this IDA instance user (it can be yours) and select decompilers. Optionally, select a Lumina and Teams server and tick the checkbox to send your license via email.

1. Click Assign button and then Click to confirm to finalize the assignment.

2. In the main subscriptions view, click on the three dots under Actions column, and in the dropdown menu, click Download license key to save it locally. You will need it to complete the installation process.

1. Navigate to the Download center on the left-side menu, locate your IDA product and base on your operating system, select an installer to download.

What's next?

Now you are ready to install your IDA instance.

Computer licenses activation

1. Go to My Hex-Rays portal. On the left menu, select a customer to see licenses assigned to it.

1. Navigate to Licenses -> Subscriptions. On the list, find the license ID and product for which you want to activate the license. Under Actions column, click on the three dots, and then in the dropdown menu, click Activate license.

1. In the new dialog, assign the ownership of the license: set the MAC address of the machine where this IDA instance will be installed and running (it can be yours) and select decompilers. Optionally, select a Lumina and Teams server and tick the checkbox to send your license via email.

1. Click Assign button and then Click to confirm to finalize the assignment.

2. In the main subscriptions view, click on the three dots under Actions column, and in the dropdown menu, click Download license key to save it locally. You will need it to complete the installation process.

1. Navigate to the Download center on the left-side menu, locate your IDA product and base on your operating system, select an installer to download.

What's next?

Now you are ready to install your IDA instance.

Server licenses for businesses and organizations

In this part, we cover the basics of license activation for floating license servers, Teams and Private Lumina servers, and the floating license server.

The Admin Guide covers the comprehensive manual regarding installation and server management.

The server installers and license files are available via My Hex-Rays portal.

License server licenses

Floating licenses are managed by administrators and require a license server to work. If you purchase the floating licenses, you will see an additional license for the license server in your Hex-Rays portal.

License server activation for admins

Similar to named and computer licenses, license server licenses need to be activated in the My Hex-Rays portal.

1. Go to My Hex-Rays portal. On the left menu, select a customer to see licenses assigned to it.

2. Navigate to Licenses -> Subscriptions. On the list, find the license server ID for which you want to activate the license. Under Actions column, click on the three dots, and then in the dropdown menu, click Activate license.

3. In the new dialog, assign the ownership to the license server and provide the MAC address of the device where the license server will be running.

4. Click Assign button and then Click to confirm to finalize the assignment.

5. In the main subscriptions view, click on the three dots under Actions column, and in the dropdown menu, click Download license key to save it locally. You will need it to complete the installation process.

6. Navigate to the Download center on the left-side menu, and select a license server installer to download.

License server installation for admins

Server installation for floating licenses should be done by the administrator. Check our Admin Guide for details.

How can I start using IDA as a floating license user?

Once your administrator installs a license server, adds particular license seats to the pool, and hands over the credentials, you are ready to install your IDA instance.

You don't need to download a license file/key to your local machine while using the floating licenses server.

Floating licenses borrowing

Every time you launch IDA, you'll see the License Manager pop-up window. As long as there are free seats, you can borrow one of the available licenses and start using IDA.

Add-ons servers' licenses

Each of our add-ons, Teams and Private Lumina, requires a separate server to work. The server license is provided with the first IDA instance/plan with the specific add-on enabled.

Teams server activation for admins

Similar to named/computer licenses and floating license server, the Teams server license needs to be activated in My Hex-Rays portal.

Teams server installation for admins

Server installation for Teams should be done by the administrator. Check our Admin Guide for details.

Private Lumina server activation for admins

Similar to named/computer licenses and floating license server, the Private Lumina server license needs to be activated in the My Hex-Rays portal.

Private Lumina server installation for admins

Server installation for Private Lumina should be done by the administrator. Check our Admin Guide for details.

This submenu allows you to produce various output files. It also allows you to unload the database.

The text file-producing operations below will make use of

Create MAP File

Please enter a file name for the map. IDA will write the following information about this file:

You can use this map file for your information, and also for debugging (for example, Periscope from Periscope Company or Borland's Turbo Debugger can read this file).

Create ASM File

Please enter a file name for the assembler text file. IDA will write the disassembled text to this file.

If some I/O problem (e.g. disk full) occurs during writing to the file, IDA will stop and a partial file will be created.

Create INC File

Please enter a file name for the assembler include file. IDA will write the information about the defined types (structures and enums) to this file.

If some I/O problem (e.g. disk full) occurs during writing to the file, IDA will stop and a partial file will be created.

Create LST File

Enter a file name for the assembler listing file. IDA will write the disassembled text to this file.

If some I/O problem (e.g. disk full) occurs during writing to the file, IDA will stop and a partial file will be created.

Create Executable File

IDA produces executable files only for:

EXE files: Output files will have the same EXE-header and relocation table as the input file. IDA will fill unused ranges of the EXE file (e.g. between relocation table and loadable pages) with zeroes.

Create Difference File

This command will prompt you for a filename and then will create a plain text difference file of the following format:

Create HTML File

Please enter a file name for the HTML file. IDA will write the disassembled text to this file.

If some I/O problem (e.g. disk full) occurs during writing to the file, IDA will stop and a partial file will be created.

This command is available only in the graphical version of IDA.

Produce flow chart GDL file

This command creates a GDL (graph description file) with the flow chart of the current function.

If there is an active selection, its flow chart will be generated.

IDA will ask for the output file name. Regardless of the specified extension, the .GDL extension will be used.

Produce call graph GDL file

This command creates a GDL (graph description file) with the graph of the function calls.

IDA will ask for the output file name. Regardless of the specified extension, the .GDL extension will be used.

Dump database to IDC file

This command saves current IDA database into a text file.

You can use it as a safety command:

This command is used when you want to switch to a new version of IDA. Usually each new version of IDA has its own database format. To create a new format database, you need:

Please note that this command does not save everything to text file. Any information about the local variables will be lost!

Create C header file

This command saves all definitions in the local types window into a C header file.

Dump typeinfo to IDC file

This command saves information about the user-defined types from the IDA database into a text file.

Information about enums, structure types and other user-defined types is saved in a text form as an IDC program.

You can use this command to migrate the type definitions from one database to another.

Explore our in-depth guides, crafted to help you navigate through IDA features and master its advanced capabilities.

By using this command, you can temporarily quit to the operating system.

This command is not available in the MS DOS version.

The database is left open when you use this command, so be careful.

 Action    name: SaveBase
 

This command saves and packs the current database.

See also other File... submenu commands. Save database as... command.

 Action    name: SaveBaseSnap
 

This command takes a database snapshot. The snapshot can be later restored from the database snapshot manager.

Note: snapshots work only with regular databases. Unpacked databases do not support them.

See also View database snapshot manager commands.

Abort IDA

This command terminates the current IDA session. The Abort command is not available if the database was not packed.

IDA will NOT save changes to the disk.

First experience with IDA? Great, you are in the right place. Here you can find guides designed to quickly onboard you into IDA. We will walk you through license activation and IDA installation to the essential tasks you can perform in IDA.

 Action    name: Quit
 

This command terminates the current IDA session. IDA will write all changes to the disk and will close all databases.

You can enable/disable database packing. When the database is packed, it consists of one file with IDB extension. When the database is not packed, it consists of several files on the disk. If packing is disabled, in the next session you cannot abort IDA. We do not recommend to leave the database in the unpacked form because you will not have a backup copy.

You can also perform garbage collection on the database before packing it. The garbage collection removes the unused database pages, making it smaller. However, IDA needs some free database pages when it works,therefore it will allocate them again when you reuse the database. Removing and adding free pages takes time and, what is most important, it changes the database control blocks.

Use garbage collection only when you do not intend to work with the database in the near future.

IDA will remember all information about the screen, cursor position, jump stack, etc. The following information will be lost: keystroke macros, the anchor position To resume a disassembly session simply type: "ida file"

See also other File... submenu commands. Abort command.

This submenu allows the user to modify text representation and to patch the file. It also has the commands to control the analysis:

• Anchor

• Export data

• Undo

• Redo

• Convert to instruction

• Convert to data

• Convert to STRLIT string

• Convert to array

• Undefine

• Rename

• Operand types submenu

• Comments submenu

• Functions submenu

• Structs submenu

• Segments submenu

• Patch program submenu

• Other submenu

• Plugins submenu

See also Menu Bar submenus.

 Action    name: Redo
 

This command reverts the previously issued Undo command. It is possible to use Redo multiple times.

This command also reverts all changes that were done to the database after the last Undo command, including the eventual useful modifications made by the autoanalysis. In other words, the entire database is modified to get to the exact state that it had before executing the last Undo command.

See also

• Undo

• Reset Undo

• Disable Undo

• Open undo history

This command clears the undo history. After it the Undo and Redo commands become unavailable. However, once the user performs a new action, IDA will again start journaling all database modifications.

A side effect of this command is fast autoanalysis: since there is no user action to revert yet, IDA does not maintain undo buffers and this speeds up the analysis.

See also

 Action    name: DisableUndo
 

This command completely disables the undo feature.

See also

• Undo

• Redo

• Reset Undo

• Open undo history

 Action    name: MakeCode
 

This command converts the current unexplored bytes to instruction(s). IDA will warn you if it is not possible.

If you have selected a range using the [anchor](../../../disassembler/navigation/anchor.md, all the bytes from this range will be converted to instructions.

If you apply this command to an instruction, it will be reanalyzed.

See also Edit submenu

 Action    name: Undo
 

This command reverts the database to the state before executing the last user action. It is possible to apply Undo multiple times, in this case multiple user actions will be reverted.

Please note the entire database is reverted, including all modifications that were made to the database after executing the user action and including the ones that are not connected to the user action. For example, if a third party plugin modified the database during or after the user action, this modification will be reverted. In theory it is possible to go back in time to the very beginning and revert the database to the state state that was present immediately after performing the very first user action. However, in practice the undo buffers overflow because of the changes made by autoanalysis. Autoanalysis generates copious amounts of undo data. Also please note that maintaining undo data during autoanalysis slows it down a bit. In practice it is not a big deal because the limit on the undo data is reached quite quickly (in a matter of minutes). Therefore, if during analysis the user does not perform any actions that modify the database, the undo feature will turn itself off temporarily.

However, if you prefer not to collect undo data at all during the initial autoanalysis, just turn off the UNDO_DURING_AA parameter in ida.cfg.

The configuration file ida.cfg has 2 more undo-related parameters:

  UNDO_MAXSIZE  max size of undo buffers; default: 128MB
                once this limit is reached, the undo info about the oldest
                user action will be forgotten.

  UNDO_DEPTH    max number of user actions to remember; default: 1000000
                if set to 0, the undo feature will be unavailable.

Since there is a limit on the size of undo buffers, any action, even the tiniest, may become non-undoable after some time. This is true because the analysis or plugins may continue to modify the database and overflow the buffers. Some massive actions, like deleting a segment, may be non-undoable just because of the sheer amount of undo data they generate.

Please note that Undo does not affect the state of IDC or Python scripts. Script variables will not change their values because of Undo. Also nothing external to the database can be changed: created files will not be deleted, etc.

Some actions cannot be undone. For example, launching a debugger or resuming from a breakpoint cannot be undone.

See also

• Redo

• Reset Undo

• Disable Undo

• Open undo history

 Action    name: MakeData
 

This command converts the current unexplored bytes to data. If it is not possible, IDA will warn you.

Multiple using of this command will change the data type:

 db -> dw -> dd -> float -> dq -> double -> dt -> packreal -> octa \;
 ^                                                                 |;
 \---------<----------------<--------------<-----------------------/;

You may remove some items from this list using setup data command.

If the target assembler does not support double words or another data type, it will be skipped. To create a structure variable, use Declare struct var command. To create an array, use Array command. To convert back, use Undefine command. See also Edit submenu

Convert to string literal

 Action    name: MakeStrlit
 

This command converts the current unexplored bytes to a string.

The set of allowed characters is specified in the configuration file, parameter StrlitChars. Character '\0' is not allowed in any case. If the current assembler does not allow characters above 0x7F, characters with high bit set are not allowed.

If the anchor has been dropped, IDA will take for the string all characters between the current cursor position and the anchor.

Use the anchor if the string starts a disallowed character.

This command also generates a name for the string. In the configuration file, you can specify the characters allowed in names (NameChars).

You can change the literal string length using Array command.

The GUI version allows you to assign a special hotkey to create Unicode strings. To do so, change the value of the StringUnicode parameter in the IDAGUI.CFG file.

Pascal Strings

To create Pascal style strings (with first byte indicating string length) use Set String Style command.

See also Edit submenu

 Action    name: MakeUnknown
 

This command deletes the current instruction or data, converting it to 'unexplored' bytes. IDA will delete the subsequent instructions if there are no more references to them (functions are never deleted).

If you have selected a range using the anchor, all the bytes in this range will be converted into 'unexplored' bytes. In this case, IDA will not delete any other instructions even if there are no references to them after the deletion.

See also Edit submenu

 Action    name: MakeArray
 

This command allows you to create arrays and change their sizes.

The arrays are created in 2 simple steps:

1. Create the first element of array using the data definition commands (data, string, structs)

2. Apply the array command to the created data item. Enter array size in current array elements (not bytes). The suggested array size is the minimum of the following values:

   Copy

        - the address of the next item with a cross reference
        - the address of the next user-defined name

For string literals, you can use this command to change the length of the string.

The dialog box contains the following fields:

Items on a line (meaningless for string literals):

        0               place maximal number of items on a line
        other value     number of items on a line

Please note that the margin parameter affects the number of items on a line too.

Alignment (meaningless for string literals):

        -1              do not align items
        0               align automatically
        other value     width of each item

 Signed elements:       if checked, IDA treats all elements as signed numbers.
                        only meaningful for numbers (not for offsets and
                        segments and strings)

 Display indexes:       if checked, IDA will display the indexes of array
                        elements in the form of comments (0,1,2...)

 Create as array:       if not checked, IDA will create a separate item for
                        each array element. Useful for creating huge arrays.
                        If the box is unchecked when this command is
                        applied to string literals, IDA will create many
                        string literals instead of one big string.

If applied to a variable-sized structure, this command is used to specify the overall size of the structure. You cannot create arrays of variable-sized structures.

See also:

• Edit submenu

• How to Enter a Number.

This submenu allows you to change the operand types to offsets, numbers, chars, etc. Use it to make disassembled text more understandable.

• Convert operand to offset

• Convert operand to number

• Convert operand to character

• Convert operand to segment

• Convert operand to enum

• Convert operand to stack variable

• Change operand sign

• Bitwise negate operand

• User-defined operand

• Set operand type

If IDA suspects that an operand can be represented as something different from a plain number, it will mark the operand as "suspicious" and show it in red. Use these commands to delete suspicious marks.

Some of these commands can be applied to a selected range. Click here to learn about the rules applied to such operations.

See also Edit submenu.

To delete a name, simply give an empty name.

Local name

Include in name list

Public name

Autogenerated name

Weak name

Create name anyway

• Convert operand to offset (data segment)

• Convert operand to offset (code segment)

• Convert operand to offset (any segment)

• Convert operand to offset (user-defined base)

• Convert operand to struct offset

Convert operand to offset (data segment)

 Action    name: OpOffset
 

This command converts the immediate operand of the current instruction/data to an offset from the current data segment (DS).

If current DS value is unknown (or equal 0xFFFF) IDA will warn you -- it will beep. In this case, you have to define DS register value for the current byte. The best way to do it is:

• jump to segment register change point

• change value of DS

• return or you can change default value of DS for the current segment.

If you want to delete offset definition, you can use this command again - it works as trigger.

If the cursor is on the first operand (the cursor is before ',') then the first operand will be affected; otherwise, all other operands will be affected.

If a range is selected using the anchor, IDA will perform 'en masse' conversion. It will convert immediate operands of all instructions in the selected range to offsets. However, IDA will ask you first the lower and upper limits of immediate operand value. If the operand value is >= lower limit and <= upper limit then the operand will be converted to offset, otherwise it will be left unmodified.

To create offsets to structure members use Convert to struct offset command.

See also:

• Enter the operand manually command.

• Set operand type

Convert operand to offset (code segment)

 Action    name: OpOffsetCs
 

This command converts the immediate operand of the current instruction/data to an offset from the current segment (CS).

If the cursor is on the first operand (the cursor is before ',') then the first operand will be affected; otherwise, all other operands will be affected.

If a range is selected using the anchor, IDA will perform 'en masse' conversion. It will convert immediate operands of all instructions in the selected range to offsets. However, IDA will ask you first the lower and upper limits of immediate operand value. If the operand value is >= lower limit and <= upper limit then the operand will be converted to offset, otherwise, it will be left unmodified.

If this command is applied to a structure member in the local types window, then IDA will create an "automatic offset". An automatic offset is an offset with the base equal to 0xFFFFFFFF. This base value means that the actual value of the base will be calculated by IDA when a structure instance is created.

To create offsets to structure members, use Convert to struct offset command.

See also:

• Enter #th operand manually commands.

• Set operand type

Convert operand to offset (any segment)

 Action    name: OpAnyOffset
 

This command converts the immediate operand of the current instruction/data to an offset from any segment.

IDA will ask to choose a base segment for the offset.

If a range is selected using the anchor, IDA will perform 'en masse' conversion. It will convert immediate operands of all instructions in the selected range to offsets. However, IDA will ask you first the lower and upper limits of immediate operand value. If the operand value is >= lower limit and <= upper limit then the operand will be converted to offset, otherwise it will be left unmodified.

If the cursor is on the first operand (the cursor is before ',') then the first operand will be affected; otherwise, all other operands will be affected.

To create offsets to structure members use Convert to struct offset command.

See also:

• Enter #th operand manually commands.

• Set operand type

Convert operand to offset (user-defined base)

Action    name: OpUserOffset

If the cursor is on the first operand (the cursor is before ',') then the first operand will be affected; otherwise, all other operands will be affected.

If the offset base is specified as 0xFFFFFFFF, then IDA will create "an automatic offset". Automatic offsets mean that the actual value of the base will be calculated by IDA.

The following offset attributes are available:

  Treat the base address as a plain number

        if checked, IDA will treat the base address as a number.
        In this case, IDA will not create a cross-reference to it
        and the base address will be printed as a number,
        not as an offset expression.

  Offset points past the main object

        Offsets of this type point past an object end.
        They do not cause an object created/deletion.

  Use image base as offset base

        These offsets are based on the image base.
        There is no need to explicitly specify the offset base.
        These offsets are displayed in a concise form:
          rva func
        instead of
          offset func - imagebase
        If you intend to reassemble the output file, execute the
        following IDC statement:
        set_inf_attr(INF_GENFLAGS, get_inf_attr(INF_GENFLAGS) & ~INFFL_ALLASM);

  Subtract operand value

        Use this option when the operand value should be substracted
        from the base to get the target address. In this case the displayed
        expression will be displayed as
          offset base - target
        instead of the usual
          offset target - base

  Signed operand

        Use this option if the operand should be interpreted
        as a signed value. This option is only available for OFF_REF8,
        OFF_REF16, OFF_REF32 and OFF_REF64 offset types.

  Operand value of 0 is invalid

        If the operand value is 0, the value will be highlighted in red.

  Operand value of NOT 0 is invalid

        If the operand value is zero's complement (i.e. all bits are set),
        the value will be highlighted in red.
        For example a OFF_REF16 with an operand value of 0xFFFF would be invalid.

  Use the current address as the offset base

The offset base is dynamically calculated and is equal to the address of the current element:

• for standalone items: their start address

• for arrays: the start of the array element

• for structures: the start of the structure field The offset expression is displayed in the following concise form: offset target - $ where "$" denotes the start of the element (and is assembler-dependent). To create offsets to structure members use Convert to struct offset command.

See also:

• Enter #th operand manually commands.

• Set operand type

Convert operand to structure offset

 Action    name: OpStructOffset
 

 GUI version:
 ------------

This command permits to convert all immediate operands of instructions in a range selection to a path of offsets through a structure and its possible sub unions. If no selection is active, IDA will simply permit to convert the current operand. In this case, it will display a simple dialog box the same way as the text version (see below).

You can select the desired register in the drop-down list: all operands relative to this register will be added to the 'Offsets' list. A special empty line in the drop-down list is used to directly work on immediate values. Checkboxes in the 'Offsets' list allow you to select which operand you indeed want to modify. By default, IDA will select only undefined operands, to avoid overwriting previous type definitions. This list is sorted by operand value, by instruction address and finally by operand number. You can easily see the instructions related to the operand by moving the mouse over it, and wait for a hint to be displayed.

The 'Structures and Unions' tree will contain all selectable structures, and sub unions. Once you select or move over a structure, the 'Offsets' list updates itself for each checked offset: the computed name of the operand is displayed, according to the selected structure in the tree. An icon is also drawn, to easily know if a specific structure matchs the offset or not, or if the offset is too big for the selected structure. The structures who match the most offsets will be near the top of the tree. You can also move your mouse over structures in the tree to obtain an interesting hint.

A '?' icon can also appear, if the offset can be specialized by selecting an union member. In this case, if you expand the structure in the tree, you can select the adequate union member simply by checking the desired radio button. IDA automatically corrects the related name in the 'Offsets' list.

The 'Offset delta' value represents the difference between the structure start and the pointer value. For example, if you have an operand 4 and want to convert in into an expression like "mystruct.field_6-2", then you have to enter 2 as the delta. Usually the delta is zero, i.e. the pointer points to the start of the structure.

The 'Hide sub structures without sub unions' option (checked by default) avoids to add unnecessary sub structures to the tree, to keep it as small as possible. If you uncheck this option, all sub structures will be added to the tree.

By default, IDA displays the structure member at offset 0. To change this behaviour, you can directly disable the 'Force zero offset field' in the 'Options' frame. Later zero offsets can be forced using Edit, Structs, Force zero offset menu item.

 Text version:
 -------------

This command converts immediate operand(s) type of the current instruction/data to an offset within the specified structure. Before using this command, you have to define a structure type.

First of all, IDA will ask a so-called "struct offset delta". This value represents the difference between the structure start and the pointer value. For example, if you have an operand 4 and want to convert in into an expression like "mystruct.field_6-2", then you have to enter 2 as the delta. Usually the delta is zero, i.e. the pointer points to the start of the structure.

If a range is selected using the anchor, IDA will perform 'en masse' conversion. It will convert immediate operands of all instructions in the selected range to offsets. However, IDA will ask you first the lower and upper limits of immediate operand value. If the an operand value is >= lower limit and <= upper limit then the operand will be converted to offset, otherwise it will be left unmodified.

When you use this command, IDA deletes the manually entered operand.

If the cursor is on the first operand (the cursor is before ',') then the first operand will be affected; otherwise, all other operands will be affected.

By default IDA doesn't display the structure member at offset 0. To change this behaviour, use Force zero field offset command.

Moreover, if there are several possible representations (this can happen if unions are used), select the desired representation using the Select union member... command.

See also:

• Enter #th operand manually command.

• Set operand type

Related topics: Edit|Operand types submenu.

If you have selected a range before applying an operand conversion command, IDA will display a dialog box.

You can choose a range of operands to perform an en masse operation:

 ALL OPERANDS
 -----------

The operation will be performed on all operands as a toggle. For example, if you ask to convert to a character, then all non-character operands will become characters, and all character operands will become non-chars.

 OPERAND VALUE RANGE
 -------------------

The operation will be performed on the void operands which contain immediate numbers in the specified range.

 ... OPERANDS
 ------------

This selection will convert all operands with the specified type to undefined operands. Example: all characters become non-characters.

 NOT ... OPERANDS
 ---------------

This selection allows to convert all operands that do not have the specified type to the specified type. Example: all non-characters to characters.

 NOT TYPED OPERANDS
 -----------------

This selection allows to convert all operands without any type to the specified type. Example: all operands with no type to characters.

 APPLY ONLY IF POSSIBLE
 ---------------------

IDA will check whether an operand can be represented with the specified type (as a character constant, for example), and perform type conversion only if the check is successful.

 Action    name: OpChar
 

This command converts immediate operand(s) type of the current instruction/data to character.

When you use this command, IDA deletes the manually entered operand.

If the cursor is on the first operand (the cursor is before ',') then the first operand will be affected; otherwise, all other operands will be affected.

See also Edit|Operand types submenu.

Convert operand to number

The number is represented in the default radix for the current processor (usually hex, but octal for PDP-11, for example).

If the cursor is on the first operand (the cursor is before ',') then the first operand will be affected; otherwise, all other operands will be affected.

Convert operand to hexadecimal number

If the cursor is on the first operand (the cursor is before ',') then the first operand will be affected; otherwise, all other operands will be affected.

Convert operand to decimal number

This command converts the immediate operand(s) type of the current instruction/data to decimal. Therefore, it becomes a 'number'.

If the cursor is on the first operand (the cursor is before ',') then the first operand will be affected; otherwise, all other operands will be affected.

Convert operand to octal number

This command makes the current instruction or data operand type octal. IDA always uses 123o notation for octal numbers even if the current assembler does not support octal numbers.

If the cursor is on the first operand (the cursor is before ',') then the first operand will be affected; otherwise, all other operands will be affected.

Convert operand to binary number

This command makes the current instruction or data operand type binary. IDA always uses 123b notation for binary numbers even if the current assembler does not support binary numbers.

If the cursor is on the first operand (the cursor is before ',') then the first operand will be affected; otherwise, all other operands will be affected.

Convert operand to floating point number

This command makes the current operand type floating point.

If the cursor is on the first operand (the cursor is before ',') then the first operand will be affected; otherwise, all other operands will be affected.

Toggle leading zeroes

This command displays or hides the leading zeroes of the current operand. Example: if the instruction looked like this:

then after applying the command it will look like this:

A complex offset expression looks like

        offset target + delta - offset base

It is specified by:

        - type (OFF16, OFF32, LOW16, etc.)
        - base
        - optional target
        - optional delta from target

The relationship between these parameters is (the formula is given for full offsets):

        operand_value = target + delta - base

  or (the same relationship in a different form):

        target = operand_value - delta + base

You always have to specify the offset type and base. Usually, the delta is equal to zero. For the full offset type you may omit the offset target, which is recommended. In this case, IDA will calculate it automatically. However, if you specify the offset target, make sure that the relationship between the parameters still holds. For the half offset types, you have to specify the target because there is no way to calculate it.

The offset types:

  8-bit full offset            :
  16-bit full offset           :
  32-bit full offset           :

    The full offsets are regular offset expressions like

        offset label

    They can occupy 8, 16, or 32 bits.
    You have to specify the offset base for these offsets.

  low 8 bits of 16-bit offset  :

    Only the low 8 bits of the offset. IDA will represent them as

        (offset label) & 0xFF

  low 16 bits of 32-bit offset :

    Only the low 16 bits of the offset. IDA will represent them as

        (offset label) & 0xFFFF

  high 8 bits of 16-bit offset :

    Only the high 8 bits of the offset. IDA will represent them as

        offset label >> 8

  high 16 bits of 32-bit offset:

    Only the high 17 bits of the offset. IDA will represent them as

        offset label >> 16

See also offset by any user-specified base

 Action    name: OpSegment
 

This command converts the immediate operand(s) type of the current instruction/data to segment base. The segment bases are usually displayed like this:

        mov     ax, seg dseg

When you use this command, IDA deletes the manually entered operand.

If IDA cannot find a segment whose base is equal to the operand value, it simply displays it as hex number.

If the cursor is on the first operand (the cursor is before ',') then the first operand will be affected; otherwise, all other operands will be affected.

See also Edit|Operand types submenu.

 Action    name: OpStackVariable
 

This command converts immediate operand(s) type of the current instruction to an offset to stack variables, i.e. a local variable or function argument in the stack.

You need to define stack variables before using this command.

If the current operand is based on the value of the stack pointer ([ESP+xxx]) and the SP value is traced incorrectly, then you need to correct SP value using change stack pointer command.

If a range is selected using the anchor, IDA will perform 'en masse' conversion. It will convert immediate operands of all instructions in the selected range to stack variables. However, IDA will ask you first the lower and upper limits of immediate operand value. If the operand value is >= lower limit and <= upper limit then the operand will be converted to stack variable, otherwise it will be left unmodified.

When you use this command, IDA deletes the manually entered operand.

If the cursor is on the first operand (the cursor is before ',') then the first operand will be affected; otherwise all other operands will be affected.

See also: Edit|Operand types submenu. Enter #th operand manually commands. Define stack variables...

 Action    name: BitwiseNegate
 

This command bit-wisely negates the current operand. Please note that not all types of operands can be negated. It is not possible to negate and change sign of an operand simultaneously.

This command works only if the current assembler supports the bitwise negation operation.

See also: Edit|Operand types submenu. Enter #th operand manually commands. Set operand type

If the selected enum is a bitfield, IDA will try to build a bitfield expression to represent the constant. Please note that for bitfields having multiple constants with the same value some expressions won't be possible.

If the cursor is on the first operand (the cursor is before ',') then the first operand will be affected; otherwise all other operands will be affected.

 Action    name: ChangeSign
 

This command changes the sign of the current operand. Please note that not all operands can change their sign.

See also: Edit|Operand types submenu. Enter #th operand manually commands. Set operand type

 Action    name: ManualOperand
 

You may specify any string instead of an operand if IDA does not represent the operand in the desired form. In this case, IDA will simply display the specified string in the instruction instead of the default operand.

The current operand (under the cursor) will be affected.

You can use this command not only with instructions but with data items too.

IDA proposes the previous manual operand as the default value in the input form.

To delete the manual operand and revert back to the default text, specify an empty string.

IDA automatically deletes manually entered operands when you change operand representation using operand types submenu.

NOTE: A text offset reference is generated if you use a label in the program as the operand string. In other cases no cross-references are generated.

See also Edit|Operand types submenu.

This submenu allows you to manipulate different kinds of comments. Use them to make the disassembled text more understandable.

• Create a regular comment

• Create repeatable comments

• Create additional comment lines

Create a regular comment

 Action    name: MakeComment
 

If you stand at the function start and your cursor is on a function name, IDA will ask you to enter a function comment.

If you stand at the segment start and your cursor is on a segment name, IDA will ask you to enter a segment comment.

If this command is issued in the local types window, it allows you to change the comment of a structure/enum, or structure/enum member. If the cursor is on the structure/enum name, the structure/enum comment will be changed, otherwise the member comment will be changed.

Otherwise, this command allows you to enter a normal indented comment for the current item.

You can show/hide all comments in Comments Dialog.

See also

• How to use the notepad

• Edit|Comments submenu, Repeatable comments

Create a repeatable comment

 Action    name: MakeRptCmt
 

This command allows you to enter a repeatable comment. A repeatable comment will appear attached to the current item and all other items referencing it.

If you stand at the function start, IDA will ask you to enter a function comment.

If this command is issued in the local types window, it allows you to change the comment of a structure/enum, or structure/enum member. If the cursor is on the structure/enum name, the structure/enum comment will be changed, otherwise the member comment will be changed.

Otherwise, this command allows you to enter a repeatable comment for the current item.

You cannot enter repeatable segment comments.

All items that refer to the current item will have this comment by default.

Note that if you have defined both comment types (regular and repeatable), the regular comment will be displayed for the current item and the repeatable comment will be displayed for all items that refer to the current item, if they do not have their own comments.

The repeatable comments may be used to describe subroutines, data items, etc., because all calls to the subroutine will have the repeatable comment.

You can show/hide all comments in the Comments Dialog.

You can show and hide repeatable comments in the Comments Dialog.

See also "How to use the notepad".

Create additional comment lines

Action                 Name
 ------                 ----
 edit anterior lines    MakeExtraLineA
 edit posterior lines   MakeExtraLineB

If you want to enter multi-line comments or additional instructions, you can use this feature of IDA.

There are two kinds of extra lines: the ones generated before the instruction line and the ones generated after the instruction line.

Do not forget that the maximal number of lines for an item is 500.

IDA does not insert a comment symbol at the beginning of the lines.

See also "How to use the notepad".

Related topics: Edit submenu.

 Action    name: SetOpType
 

This command allows you to specify the type of the operand under the cursor.

The operand type must be entered as a C declaration. Currently IDA itself does not use the operand type information. However, it can be used by the Hex-Rays decompiler plugin. Setting operand type is most useful in case of indirect calls: the decompiler will use the type information to determine the input parameters to the call instead of guessing, which can make the decompiled code better.

An example of a type declaration:

        int (*func)(int param1, char param2);

To delete a type declaration, enter an empty string.

For details on possible calling conventions, see Set function/item type... menu item description.

See also Set function/item type...

This submenu allows you to manipulate the structures in specific operations. The following commands are accessible from the disassembly window.

• Struct var...

• Force zero field offset

• Select union member...

• Create struct from selection

• Copy field info to pointers...

Use regular commands to specify struct and union members, their types, comments, etc.

A union is a special kind of structure. Use structure definition commands to manipulate unions.

See also Edit submenu.

Declare a structure variable

 Action    name: MakeStructVar
 

This command declares a variable of the specified structure type.

IDA will ask you to choose a structure type. You must have some structure types defined in order to use this command.

If the target assembler supports it, IDA will display the structure in terse form (using just one line). To uncollapse a terse structure variable use the Unhide command.

You can also use this command to declare a structure field in another structure (i.e. nested structures are supported too).

Force zero field offset

 Action    name: ZeroStructOffset
 

This command forces IDA to display a full structure member name even if the offset of the member is equal to zero.

If used twice, the command cancels itself.

Example: Suppose we have the following structure:

        xxx     struc
        a       db ?
        b       db ?
        c       db ?
        xxx     ends

        dloc    xxx ?

  Normally IDA displays references to it like this:

        mov     eax, offset dloc
        mov     eax, offset dloc.b

  If you force IDA, then it displays member 'a':

        mov     eax, offset dloc.a
        mov     eax, offset dloc.b

Select union member

 Action    name: SelectUnionMember
 

This command tells IDA how to display references to a union from the current cursor location.

Example: Suppose we have the following union:

        xxx     union
        a       db ?
        b       dw ?
        c       dd ?
        ends   xxx

        dloc    xxx ?

  Normally, IDA displays references to "dloc" like this:

        mov     al,  byte ptr dloc
        mov     eax, word ptr dloc

  After using this command, IDA can display the union members:

        mov     al,  dloc.b
        mov     eax, dloc.d

Create a new structure from current data

Action    name: CreateStructFromData
 

This command defines a new structure from data already defined. The new structure is created with adequate data types, and each member uses the current data name if it is available.

This command is available only in the graphical version of IDA.

Copy field info to pointers

 Action    name: CopyFieldsToPointers
 

This command scans the current struct variable and renames the locations pointed by offset expressions unless they already have a non-dummy name.

It also copies the type info from the struct members to pointed locations.

• Create alignment directive...

• Manual instruction...

• Color instruction...

• Hide/show border

See also Edit submenu.

Create alignment directive

Action    name: MakeAlignment
 

This command allows you to create an alignment directive. The alignment directive will replace a number of useless bytes inserted by the linker to align code and data to paragraph boundary or any other address which is equal to a power of two.

You can select a range to be converted to an alignment directive. If you have selected a range, IDA will try to determine a correct alignment automatically.

There are at least two requirements for this command to work:

• there must be enough unexplored bytes at the current address.

• an alignment directive must always end at an address which is divisible by a power or two.

See also

• How to Enter an Address.

Specify instruction representation manually

Action    name: ManualInstruction
 

This command allows you to specify the representation of an instruction or data in the program.

Use it if IDA cannot represent the current instruction as desired. If the instruction itself is ok and only one operand is misrepresented, then use Enter operand manually command.

To delete the manual representation, specify an empty string.

Specify instruction color

Action    name: ColorInstruction
 

This command allows you to specify the background color for the current instruction or data item.

Only GUI version supports different background colors. Specifying a non-defined custom color will reset the instruction color.

Hide/unhide a border

Action    name: ToggleBorder
 

This command allows you to hide a thin border which is like the one generated automatically by IDA between instructions and data. If the border was already hidden, then it is displayed again.

Note that you can hide all borders at once in the Comments Dialog.

This submenu allows you to patch the image of the input file. More precisely, IDA never modifies the input file. The image of the input file which was loaded to the database will be modified.

You can modify the image of the input file:

        - change a byte
        - change a word
        - enter an assembler instruction (only for IBM PC)

IDA will display the original value, the current value and file offset. If the file offset is equal to 0xFFFFFFFF then the current byte comes from a compressed page (LX/LE/NE iterated pages, for example) and/or it is not possible to tell the file position.

You can create a difference file and use an external tool to apply the patches or you can apply the patches directly to the file using IDA.

The following commands are available:

• Patch byte or word

• Assemble...

• Apply patches to input file...

See also:

• Produce EXE file

• Produce DIF file

• Edit submenu.

Patching the Image

Action    name: PatchByte, PatchWord
 

You can modify the executable file and eventually generate a new file.

If you patch bytes, then you may enter multiple bytes. Follow this link to learn about format of the input string.

If this command is invoked when the debugger is active, then IDA will modify the memory and the database. If the database does not contain the patched bytes, then only the process memory will be modified.

You can create a difference file too.

See also How to Enter a Number.

Apply patches to input file

Action    name: ApplyPatches
 

Apply previously patched bytes back to the input file. If the "Restore" option is selected then the original bytes will be applied to the input file.

See also Produce DIF file.

Binary string format

It is possible to enter a sequence of the following items:

  - a number in the selected radix (hexadecimal, decimal or octal)
  - a string constant: "string"
  - a Unicode string constant: L"unicode string"
  - a question mark '?' to ignore variable bytes

The sequence must be separated by a space or a comma.

An entered number will occupy the minimal number of bytes it fits in with the restriction that the number of bytes is a power of 2 (1, 2, or 4 bytes).

Two question marks without a space between them are the same as one question mark. One question mark corresponds to one CPU byte. One CPU byte may consist of multiple octets for a wide-byte CPU, like TMS320C28.

Example:

  CD 21          - bytes 0xCD, 0x21
  21CD           - bytes 0xCD, 0x21 (the order depends on the endiannes)
  "Hello", 0     - the null terminated string "Hello"
  L"Hello"       - 'H', 0, 'e', 0, 'l', 0, 'l', 0, 'o', 0
  B8 ? ? ? ? 90  - byte 0xB8, 4 bytes with any value, byte 0x90

Assemble an instruction

Action    name: Assemble
 

This command allows you to assemble instructions. Currently, only the IBM PC processors provide an assembler, nonetheless, plugin writers can extend or totally replace the built-in assembler by writing their own.

The assembler requires to enclose all memory references into square brackets. For example:

        mov ax, [counter]

Also, the keyword 'offset' must not be used. Instead of

        mov eax, offset name

you must write

        mov eax, name

See also How to Enter a Number.