Only this pageAll pages
Powered by GitBook
Couldn't generate the PDF for 1011 pages, generation stopped at 100.
Extend with 50 more pages.
1 of 100

IDA 9.0sp1

Loading...

Loading...

Loading...

Loading...

Loading...

Loading...

Loading...

Loading...

User Interface

Loading...

Loading...

Loading...

Loading...

Loading...

Loading...

Loading...

Loading...

Loading...

Save database as...

Loading...

Loading...

Loading...

Loading...

Loading...

Loading...

Loading...

Loading...

Loading...

Loading...

Loading...

Loading...

Loading...

Loading...

Loading...

Loading...

Loading...

Loading...

Loading...

Loading...

Loading...

Loading...

Loading...

Loading...

Loading...

Loading...

Loading...

Loading...

Loading...

Loading...

Loading...

Loading...

Loading...

Loading...

Plugins

Loading...

Loading...

Loading...

Loading...

Loading...

Loading...

Loading...

Loading...

Loading...

Loading...

Loading...

Loading...

Loading...

Loading...

Loading...

Loading...

Loading...

Loading...

Loading...

Loading...

Loading...

Loading...

Loading...

Loading...

Loading...

Loading...

Loading...

Loading...

Process Control

Loading...

Loading...

Loading...

Loading...

Loading...

Loading...

Loading...

Loading...

Loading...

Loading...

Loading...

Loading...

Loading...

Loading...

Loading...

Loading...

Loading...

Basic Usage

Basic Usage

In this document, we'll explore the essentials of IDA capabilities to kickstart your journey and disassemble your first binary file.

Prerequisites

Before you begin

What files and processors are supported?

What are IDA database files?

IDA stores the analysis results in the IDA Database files (called IDB), with the extension .i64. This allows you to save your work and continue from the same point later. After loading a file at the beginning, IDA does not require access to the binary.

Any modifications you make are saved in the database and do not affect the original executable file.

Dive deeper

What decompilers can I work with?

IDA provides decompilers designed to work with multiple processor architectures. The number of decompilers and their type (local or remote) available in your IDA instance depends on your chosen product and subscription plan and affects your ability to produce C-like pseudocode.

Where can I find exemplary binaries to work with?

Part 1: Loading your file

When you launch IDA, you will see a Quick Start dialog that offers three ways to continue. For now, we'll focus on loading a new file and proceeding to disassembly results.

  1. Launch IDA and in the Quick start dialog (1), click New.

  2. Specify the path for your binary file.

  3. In the Load a new file dialog (2), IDA presents loaders that are suited to deal with a selected file. Accepting the loader default selection and then the processor type is a good strategy for beginners. Click OK to confirm your selection.

  1. IDA begins autoanalysis of your binary file.

Dive deeper

Part 2: UI overview

After autoanalysis is done, you'll see the main IDA desktop with the initial results. Let's examine the default desktop layout and commonly used UI elements.

  1. Main menu bar (1)

  2. Toolbar (2)

  3. Navigation band (3)

  4. Subviews (4)

  5. Output (5)

  6. Status bar (6)

Main menu bar

For a handy cheatsheet of all commands and their hotkeys, check Options -> Show command palette....

Dive deeper

Toolbar

Below the main menu bar, you will see a toolbar with icons that give you quick access to common functionalities (available also via the main menu/shortcuts). It has just one line by default, but you can customize it by adding or rearranging your actions.

Dive deeper

Navigation band

The navigation band shows the graphical representation of the analyzed binary file and gives a short overview of its contents and which areas may need your attention. The yellow arrow (indicator) shows where the cursor is currently positioned in the disassembly view.

As you'll soon recognize, the colors used in the nav band match those in other views.

Dive deeper

Output

Status bar

At the bottom left corner of the IDA window, you can see the status bar, which contains:

  • analysis indicator AU, which shows the actual status of autoanalysis (1). In our case, it is idle, which means the autoanalysis is already finished.

  • search direction indicator (2)

  • remaining free disk space (3)

Right-clicking on the status bar brings up a context menu that allows you to reanalyze the program.

Dive deeper

Subviews

The subviews are one of the most prominent parts of your everyday work with IDA. These additional views (behaving like tabs) give a different perspective and information on the binary file, but the number of native IDA subviews may be a bit overwhelming. Here, we will focus on the most versatile and common subviews for beginners, where you'll spend most of the time, like:

  • IDA View

  • Pseudocode

  • Hex Dump View

  • Local Types

  • Functions View

IDA View / Disassembly Window

When autoanalysis is done, you will see a graph view inside an IDA View by default. This flowchart graph should help you to understand the flow of the functions.

The graph view is available only for the part of the binary that IDA has recognized as functions.

IDA view has three modes:

  • graph view (1), that shows instructions grouped in blocks,

  • linear view (2), that lists all instructions and data in order of their addresses,

  • and proximity view (3), which allows you to see relations between functions, global variables, and other parts of the program.

Press Space to switch between graph and linear mode. Proximity view is available from the context menu in IDA view.

Dive deeper

Hex View Window

In hex view, you can see the raw bytes of the program's instructions.

There are two ways of highlighting the data in this view:

  1. Text match highlight, which shows matches of the selected text anywhere in the views.

  2. Current item highlight, which shows the bytes group constituting the current item.

The IDA view, pseudocode, and hex view can be synchronized, meaning that they highlight the same part of the analyzed program, and changes made inside one of the views are visible in the others.

Dive deeper

Pseudocode Window

Generated by the famous F5 shortcut, the pseudocode shows the assembly language translated into human-readable, C-like pseudocode. Click Tab to jump right into the Pseudocode view.

Local Types Window

This view shows the high-level types used in databases, like structs or enums.

Dive deeper

Functions Window

This window displays all the functions recognized by IDA, along with key details for each:

  • Function name

  • Segment the segment that contains the function

  • Start: the function starting address

  • Length: the size of the function in bytes

  • Local: the amount of stack space taken by local variables

  • Arguments: the amount of stack space taken by arguments

This view is read-only, but you can automatically synchronize the function list with the IDA view, pseudocode, or hex view. Click to open the context menu and select Turn on synchronization.

Dive deeper

Part 3: Basic navigation

A crucial step in mastering IDA is learning how to navigate quickly to specific locations in the output. To help you get started, we'll cover essential commands and hotkeys commonly used for efficient navigation in IDA.

Double-click and jump to the location

When you double-click on an item, such as a name or address, IDA automatically jumps to that location and relocate the display.

Jump to address

  1. Go to Jump -> Jump to address.. or press G hotkey

  2. Enter the item name or hex address in the dialog box, then click OK.

To jump back to the previous position, press Esc. To jump to the next position, press Ctrl + Enter. You can also navigate using the arrows in the toolbar.

See the list of cross-references

  1. Position the cursor on a function or instruction, then go to Jump -> Jump to xref to operand... or press X to see the dialog with listed all cross-references to this identifier.

  2. Select an item from the list and click OK to jump to that location.

Dive deeper

Part 4: Manipulate your disassembly results

Now that the initial autoanalysis is done and you’ve mastered the basics of navigation, it’s time to explore the basic interactive operations that reveal the true power of IDA in transforming your analysis.

Rename a stack variable

One of the first steps you might take is to enhance readability by assigning meaningful names to local or global variables, but also functions, registers and other objects that IDA initially assigned a dummy name.

  1. In the IDA View, right-click on the variable you want to rename and click Rename or press N when the variable is cursor-highlighted.

  2. In the newly opened dialog, insert a new name and click OK.

If at any point you want to go back to the original dummy name given by IDA, leave the field blank and click OK. It will reset the name to the default one.

Once you change the name, IDA will propagate the changes through the decompiler and Pseudocode view.

Dive deeper

Add a comment

Adding comments may be a useful way to annotate your work.

  1. Highlight the line where you want to insert a comment and press :.

  2. In the dialog box, type your comment (you can use multiple lines) and click OK. This will add a regular (non-repeatable) comment to the location.

If you want to add a repeatable comment in every location that refers to the original comment, press ';'.

Dive deeper

Part 5: Customizing IDA

Nearly every UI element is customizable, allowing you to rearrange and align widgets to suit your habits. You can save your personalized desktop layout by going to Windows -> Save desktop.

Most of the basic appearance you can change under Options menu.

  • To change the colors or theme, go to Options -> Colors.

  • To change the font, go to Options -> Fonts.

Part 6: Debug your file

If you are ready to delve into dynamic analysis and start debugging your programs, here are some key steps to get you started:

  1. Select the right debugger and complete the setup: Go to Debugger -> Select debugger... and pick up one of the available debuggers. Under Debugger -> Debugger options, you can configure the setup in detail.

  2. Add breakpoints: Right-click on the line where you want to stop the execution and select Add breakpoint from the context menu, or press F2.

  3. Start the process: Run the debugging session by pressing F9 or click a green arrow on the tooltip.

Dive Deeper

Part 7: Install a plugin

One of the most common way of extending IDA capabilities is to use one of our community-developed plugins.

Where can I find IDA plugins?

Installing your plugin

For this guide purposes, we'll walk you through general installation steps.

The installation process can vary depending on the plugin and some of them may required installing dependencies or further configuration. Don't hesitate to refer to the specific instructions provided by the plugin author.

Load your plugin

  1. Copy your plugin folder to the plugins directory inside your IDA installation directory.

  2. Alternatively, you can load the plugin from the command line in IDA by using File -> Script file... and selecting app.entry.py file.

Run your plugin

  1. Navigate to Edit -> Plugins -> your_plugin_name or use the assigned hotkey.

You may need to restart IDA to see your plugin in the list.

Dive deeper

Key hotkeys cheatsheet

Here's a handy list of all of the shortcuts we used so far.

  • Space Switches between graph and linear mode in the IDA View

  • F5 Generates pseudocode

  • Tab Jumps into pseudocode View

  • G Opens Jump to address dialog

  • Esc Jumps back to the previous position

  • Ctrl + Enter Jumps to the next position

  • X Shows the list of all cross-references

  • N Opens dialog to rename the current item

  • ; Adds repeatable comment

  • : Adds regular comment

Your IDA instance is .

IDA natively recognizes plenty of and .

If you later realize that's not enough, you can always use one of our community plugins that add additional formats or processor types or try to write your own with .

Blog: Check what exactly IDB contains in about IDA database.

Check , from where you can download executable files to test your reverse engineering skills.

After completion, you will be present with the default IDA desktop layout, that we'll describe in the .

Video: Watch different ways of in our .

The main menu bar provides quick access to essential features. Moreover, almost all menu commands can be quickly accessible via customizable .

Docs: Check our for a comprehensive description of all menu items.

Video: Curious about practical ways to set up your toolbar? Watch our .

Blog: A detailed navigation band overview with the full colors legend you can found in .

The output window is a place where various messages and logs are displaying, often describing what currently IDA is doing, like analyzing data or running a script. In the CLI box you can type commands in or .

Docs: To check all possible values and their meaning, take a look at .

Video: Check our covering the basics of graph view.

Blog: Read the in Igor's tip of the week.

Video: Listen about hex view and others in our .

Blog: Detailed you can read in Igor's tip of the week.

Docs: Check our manual giving an overview of .

By default, the entire window is not visible, so you may scroll horizontally to see the hidden elements. As you probably noticed, the colors in Functions window match the colors in navigation band; in our example, green highlighting shows functions recognized by .

Docs: Read the manual explaining all of the columns in detail.

Video: Watch our exploring the functions view.

Video: Explore the rest of the jump commands in our

Docs: Check the details on renaming items in the

Video: Watch our on renaming techniques.

Blog: Check for expert advice on renaming.

Video: Watch our about commenting.

If you need more control over customization settings, you may check the .

Docs: Read our User Guide for and debugging manuals, or check step-by-step tutorials for specific debuggers.

You can find a variety of plugins in the official Hex-Rays

Docs: Want to learn about writing your own plugins? Check our Developer Guide on how to create a plugin in or with .

installed and running
file formats
processors
C++ SDK
📝
Igor's tip of the week
CrackMe
📹
loading files
channel
shortcuts
📖
User Guide
📹
video tutorial
📝
Igor's tip of the week
IDC language
IDAPython
📹
video tutorial
📝
graph mode overview
📹
video tutorial
📝
overview of the hex view
Lumina
📹
video tutorial
📹
video tutorial
📖
User Guide
📹
step-by-step tutorial
📝
Igor's tips of the week
📹
tutorial
IDA configuration files
📖
local
remote
plugin repository
📖
IDAPython
C++ SDK
next part

Licensing

In this document, we covered the basics regarding our licensing model: you can check how to activate your license depending on the license type, what to do with the downloaded license files, and how to finalize license settings while running IDA. This guide is dedicated to individual users.

Licenses overview

License types

In Hex-Rays, we offer two basic license types for IDA products, that are suitable for individual users:

  • Named licenses, that are assigned to specific individuals.

  • Computer licenses that are assigned to specific devices.

There is also an additional type, called floating licenses, that allow a set number of concurrent users but are not assigned to specific individuals or devices.

Floating licenses are available only for IDA Pro and dedicated to business/organization purposes.

What are license files, and where can I find them?

The license file contains your license ID and other data and is required to make your IDA instance fully operative after installation.

License Activation

To complete the installation, you need an active IDA license with an assigned owner or a MAC address. Without activation, you cannot download your license file.

What is needed to assign my license?

  • for named licenses: the email address of the owner,

  • for computer licenses: the MAC address of a specific device

  • for floating licenses: the MAC address of the device where the license server will be running

The license type (named/computer) is selected when you purchase your subscription.

Named licenses activation

  1. Locate the license ID you want to activate. Ensure it has the Pending activation status.

  2. Under the Actions column, click the three dots and then Activate License from the dropdown menu.

If you haven't completed the KYC procedure yet, you will need to do so for accessing paid products. If the "Activate License" option is not visible despite a Pending Activation status, it means your KYC process is still in progress.

  1. In the new dialog, assign the ownership of the license: set the email address for this IDA instance user (it can be yours) and select decompilers. Optionally, select a Lumina or Teams server and tick the checkbox to send the license via email.

  1. Click Assign button and then Click to confirm to finalize the assignment. Your license is now active, and you can download your license key.

Download the license key and installer

  1. In the main Licenses view, click the three dots under Actions column and in the dropdown menu, click Download key to save it locally. You will need it to complete the installation process.

What's next?

Computer licenses activation

  1. Locate the license ID you want to activate. Ensure it has the Pending activation status.

  2. Under the Actions column, click the three dots and then Activate License from the dropdown menu.

If you haven't completed the KYC procedure yet, you will need to do so for accessing paid products. If the "Activate License" option is not visible despite a Pending Activation status, it means your KYC process is still in progress.

  1. In the new dialog, assign the ownership of the license: set the MAC address of the machine where this IDA instance will be installed and running (it can be yours) and select decompilers. Optionally, select a Lumina and Teams server and tick the checkbox to send your license via email.

  1. Click Assign button and then Click to confirm to finalize the assignment. Your license is now active, and you can download your license key.

Download the license key and installer

  1. In the main Licenses view, click the three dots under Actions column and in the dropdown menu, click Download key to save it locally. You will need it to complete the installation process.

What's next?


Server licenses for businesses and organizations

In this part, we cover the basics of license activation for Teams and Private Lumina servers, and the floating license server.

The server installers and license files are available via My Hex-Rays portal.

License server licenses

Floating licenses are managed by administrators and require a license server to work. If you purchase the floating licenses, you will see an additional license for the license server in your Hex-Rays portal.

License server activation for admins

Similar to named and computer licenses, license server licenses need to be activated in My Hex-Rays portal.

If you're using floating licenses, activate your server license before activating your IDA license. The server's license ID is required to activate your IDA instance.

  1. Locate the license ID you want to activate. Ensure it has the Pending activation status.

  2. Under the Actions column, click the three dots and select Activate License from the dropdown menu.

  1. In the new dialog, assign the ownership to the license server and provide the MAC address of the device where the license server will be running.

  1. Click Assign button and then Click to confirm to finalize the assignment. Your license is now active, and you can download your license key and certificate.

Link your IDA instance to the license server: IDA license activation

  1. Navigate to the Licenses tab and look for your IDA license marked with -floating. Ensure it has the Pending activation status.

  2. Under the Actions column, click the three dots and then Activate License from the dropdown menu.

  1. In the new dialog:

    • select decompilers;

    • under Link to License server, select the license server ID;

    • enter your email address to receive the license file.

  1. Click Assign button and then Click to confirm to finalize the assignment. Your IDA license is now active, and you can download your license key.

License server installation for admins

How can I start using IDA as a floating license user?

You don't need to download a license file/key to your local machine while using the floating licenses server.

Floating licenses borrowing

Every time you launch IDA, you'll see the License Manager pop-up window. As long as there are free seats, you can borrow one of the available licenses and start using IDA.

Note that some of the available licenses may have different decompilers and add-ons enabled.

Add-ons servers' licenses

Each of our add-ons, Teams and Private Lumina, requires a separate server to work. The server license is provided with the first IDA instance/plan with the specific add-on enabled.

Teams server activation for admins

Similar to named/computer licenses and floating license server, the Teams server license needs to be activated in My Hex-Rays portal.

Teams server installation for admins

Private Lumina server activation for admins

Similar to named/computer licenses and floating license server, the Private Lumina server license needs to be activated in My Hex-Rays portal.

Private Lumina server installation for admins


Welcome to Hex-Rays docs

Discover the core of Hex-Rays guides and manuals, guiding you through IDA features and real-life usage scenarios.

Getting Started

New to IDA? Explore our selection of documentation to guide you through the installation process and jumpstart your reverse engineering journey.

Our Guides

Delve into detailed guides to discover IDA features and maximize its capabilities.

What's next?

📖
📖
📖

You can download your license file from , after its activation.

Go to portal and navigate to the Licenses tab.

Navigate to the on the left menu, locate your IDA product and base on your operating system, select an installer to download.

Now you are ready to .

Go to portal and navigate to the Licenses tab.

Navigate to the on the left menu, locate your IDA product and base on your operating system, select an installer to download.

Now you are ready to .

The covers the comprehensive manual regarding installation and server management.

Go to portal and navigate to the Licenses tab.

Navigate to the on the left menu, and select a license server installer to download.

Server installation for floating licenses should be done by the administrator. Check our for details.

Once your administrator installs a license server, adds particular license seats to the pool, and hands over the credentials, you are ready to .

Server installation for Teams should be done by the administrator. Check our for details.

Server installation for Private Lumina should be done by the administrator. Check our for details.

My Hex-Rays portal
My Hex-Rays
Download center
My Hex-Rays
Download center
Admin Guide
My Hex-Rays
Download center
Admin Guide
Admin Guide
Admin Guide

File

In this submenu you can:

Menu Bar

All IDA commands are available from the followings menus:

Get your IDA instance up and running on your local machine.

Check how to handle your license key file to keep IDA subscription active.

Reverse your first binary file and discover the capabilities of disassembly and decompilation.

Explore the main IDA interface and features, learn how to customize your experience and take advantage of plugins or utilities.

Discover our Developer Kit, featuring the and . Additionally, explore the IDC scripting language.

Check how to install and manage Teams and Lumina servers as well as handle floating licenses.

Maksimize your IDA experience with trainigs tailored to all skill levels.

Explore the full collection of IDA Pro tutorial videos on our Hex-Rays channel.

Read in-depth manuals that cover every aspect of IDA.

Learn more about IDA with Igor's tip of the week and explore recent news from Hex-Rays.

Load file

Execute a script command

Generate output file

Execute OS commands

Save database in packed form

Save database in packed form in another file

Take database snapshot

Abort - do not save changes

Quit to DOS - save changes

See also submenus.

Install IDA
Manage your license
Check basic features
User Guide
Developer Guide
IDA C++ SDK
IDAPython API
Admin Guide
Enroll in our trainings
Watch tutorials
Delve into the User Guide
Check the blog
Load file
Script command
Produce output file
OS shell
Save database
Save database as...
Take database snapshot
Abort
Quit
Menu Bar
File
Edit
Jump
Search
View
Debugger
Lumina
Options
Windows

What's new?

Check the latest changes in the Hex-Rays documentation, including new tutorials and manuals, along with significant revisions to existing content.

December 2024

Updated Porting Guides

New IDAPython examples

Revamped IDAPython reference

November 2024

Other updates

October 2024

With IDA 9.0, we changed how the Hex-Rays documentation is organized and added new guides and tutorials to kickstart your IDA journey and ease the migration from previous IDA versions.

New Structure

Our docs are divided into three main categories:

New Getting Started Guides

Migration and Porting Guides

New features described

Getting Started

First experience with IDA? Great, you are in the right place. Here you can find guides designed to quickly onboard you into IDA. We will walk you through license activation and IDA installation to the essential tasks you can perform in IDA.

With the recent changes to our API that came into life with SP1 for IDA 9.0, we updated Porting Guides for and .

With the new or reworked IDAPython examples that were added to our , we revamped the examples categories to make the navigation among them more intuitive. Take a look at the new category for samples that utilize our updated Types endpoints.

We updated the UI layout of and improve cross-referencing.

To reflect the current state of Local Types window as a one hub to all types-related operations, we updated the .

, dedicated to individual users and covering whole IDA products (including add-ons, like Teams and Lumina). Most of the documentation regarding IDA, like manuals or tutorials, is currently accessible under the User Guide.

, which focuses on developer's needs, covers the reference and contextual documentation for IDAPython API and C++ SDK, as well as native IDC language. This part is mainly dedicated to plugin authors and devs interested in enhancing basic IDA capabilities with our development kit or scripting.

mainly focuses on administrators installing and managing servers for Teams and Lumina or floating licenses.

In , we gathered docs with rather historical value that some of you may still find interesting but focused on previous versions of IDA.

We prepared a section for IDA newbies and also gathered additional materials to help you find your way around our or .

For those familiar with previous versions of IDA, we prepared Porting Guides for and . If you use the Flexera server for floating licenses, check our .

We added installation and setup guides for plugin and .

IDAPython
C++ SDK
IDAPython Reference Documentation
Subviews
User Guide
Developer Guide
Admin Guide
Archive
Getting Started
IDAPython API
IDA SDK
IDAPython
C++ SDK
Migration Guide for new Hex-Rays license server
IDA Feeds
idalib

Load file

This submenu allows you to load additional files into the database.

Reload the input file

Action    name: ReloadFile

This command reloads the same input file into the database. IDA tries to retain as much information as possible in the database. All the names, comments, segmentation information and similar will be retained.

Only the values of individual bytes will be changed.

Load additional file

 Action    name: LoadFile
 

This command loads a binary file. The new file is added to the current database and all existing information is retained.

The file content will appear as unexplored bytes in the program.

This command only allows you to load binary files.

Load IDS file

 Action    name: LoadIdsFile
 

This command loads an IDS file.

An IDS file contains information about well-known functions (such as functions from MS Windows API), namely:

        - their names
        - their ordinal number in the DLL
        - an eventual informative comment
        - the number of parameters passed on the stack
        - the number of parameters purged when returning

IDS files are automatically loaded if they are found in the IDS directory. This command allows you to load an IDS file from any directory, even after the main file has been loaded into the database.

Load debug information file

 Action    name: LoadDbgFile
 

This command loads a DBG file.

If the program being disassembled has a companion DBG file, then this command may be used to load information from a DBG file into the database. IDA loads DBG files automatically if it can find them in the directory with the input file.

The built-in debug information loader cannot load NB10 format files and PDB files. To load those files, please use a special plugin, PDB.DLL, which can be run manually using Edit->Plugins submenu. This plugin uses MS Windows DLLs to load the debug information and therefore has the following limitations:

        - it works only under MS Windows
        - it will load only PDBs compatible with the currently
          installed IMAGEHLP.DLL

Load PDB debug information file

 Action    name: LoadPdbFile
 

This command loads a PDB file.

If the program being disassembled has a companion PDB file, then this command may be used to load information from the PDB file into the database.

By default IDA uses in-house code to parse and load PDB files. However, our code can not parse old v2.0 PDB files. For them, IDA can fall back to using Microsoft DLLs (the default is "do not fall back"). Please read more in cfg/pdb.cfg.

Command line switch '-Opdb:option1:option2' overrides for ida session the value in cfg/pdb.cfg.

List of options

  off    : disable PDB
  pdbida : uses Hex-rays in-house code to parse and load PDB files.
  msdia  : uses Microsoft DLLs to parse and load PDB files.
           only available on Windows, for Linux/Macos you need to configure
           win32_remote.exe or win64_remote64.exe server in cfg/pdb.cfg
  fallback   : fallback from pdbida to msdia for the old 2.0 format
  nofallback : no fallback to msdia

Example

  -Opdb:off

Ida will not load PDB plugin for this session.

Load TDS debug information file

 Action    name: LoadTdsFile
 

This command loads a TDS file.

If the program being disassembled has a companion TDS file, this command may be used to load information from the TDS file into the database.

The TDS file must be placed in the same directory together with the input file.

The LoadTdsFile command launches a special plugin TDS.DLL which can be run manually using Edit->Plugins submenu.

Load FLIRT signature file

 Action    name: LoadSigFile
 

This command allows you to apply an additional signature file to the program.

A signature file contains patterns of standard runtime functions. With their help, IDA is able to recognize the standard functions and names them accordingly.

IDA attempts to detect the necessary signature files automatically but unfortunately, this is not always possible. This command adds the specified signature file into the planned signature files queue.

Signature files reside in the subdirectories of the SIG directory. Each processor has its own subdirectory. The name of the subdirectory is equivalent to the name of the processor module file (z80 for z80.w32, for example). Note: IBM PC signatures are located in the SIG directory itself. Note: the IDASGN environment variable can be used to specify the location of the signatures directory.

There is another way to load a signature file: you may insert/delete signature files in the following way:

        - open the signatures window
        - press Ins to insert a signature file to the queue
        - press Del to delete a signature file from the queue

This is a preferred way of applying signatures because useful information, such as the number of identified functions is displayed in the signature window.

FLIRT works only for the processors with normal byte size. The byte size must be equal to 8 (processors with wide bytes like AVR or DSP56K are not supported)

Load C header

 Action    name: LoadHeaderFile
 

This command allows you to apply type declarations from a C header file to the program.

IDA reads and parses the specified header file as a C compiler does. In other words, it mimics the front-end of a C compiler with some restrictions:

        - only type declarations are allowed. The function definitions
          in the input file are skipped
        - not all C++ header files are not supported, only simple classes can
          be parsed
        - the compiler specific predefined macros are not defined,
          you have to define them manually in the header file

In the case of an error in the input file, the error messages appear in the message window. In any case, the function declarations that are already parsed are not deleted from the database. IDA stops parsing the input file when 20 errors occur.

See also

IDAClang plugin

To enable the IDAClang parser, go to Options>Compiler>Source parser, and select "clang". Then use 'File>Load file>Parse C header file' to invoke the parser on a given source file.

Since IDAClang is based on the third-party libclang parser, it can only parse standalone source files that contain valid C/C++/Objective-C syntax.

Check how to activate your license in My Hex-Rays portal.

Get smoothly through installation process on your machine.

Check basic features of IDA and reverse your first binary.

examples library

This command works for some input file types only: if the file was loaded into the database with special settings, this command may fail. In this case, use command and reload the file manually.

See also commands.

See also commands.

See also commands.

See also commands.

See also commands.

See also commands.

Don't forget to specify the compiler and memory model in the dialog box before loading a header file.

All type declarations found in the input file are stored in the current database in the form of a type library. These type declarations can be used to define new structure and enumeration definitions by pressing "Add standard structure" or "Add standard enum" buttons in the and dialog boxes.

IDA 7.7 introduced an based on libclang.

commands.

The IDAClang plugin is shipped with IDA, and it provides the ability to parse header files that contain arbitrarily complex C/C++/Objective-C source code using the action.

See also command.

See also commands.

Script file
Load... submenu
Load... submenu
Load... submenu
Load... submenu
Load... submenu
Load... submenu
Load... submenu
other File... submenu
Reload input file
Binary file
IDS file
Debug information file
PDB debug information file
TDS debug information file
FLIRT signature file
C header file
alternative header file parser
IDAClang plugin
Load C header
Load C header
Activate your license
Install your IDA
Start using IDA

Take database snapshot

 Action    name: SaveBaseSnap
 

This command takes a database snapshot. The snapshot can be later restored from the database snapshot manager.

Note: snapshots work only with regular databases. Unpacked databases do not support them.

User Guide

Explore our in-depth guides, crafted to help you navigate through IDA features and master its advanced capabilities.

Abort IDA

Abort IDA

 Action    name: Abort
 

This command terminates the current IDA session. The Abort command is not available if the database was not packed.

IDA will NOT save changes to the disk.

Script File

 Action    name: Execute
 

Script command

 Action    name: ExecuteLine
 

You can enter and execute a small script written in the built-in IDC language or any other registered extlang.

See also:

See also commands.

See also commands. command.

You can execute any script file supported by the built-in scripting engine ( or Python), or a scripting language added by a plugin. The scripting language to use is selected by the file name extension of the script.

See also of script commands, commands.

Here is the list of functions.

language overview

Execute command

commands

How to use .

View database snapshot manager
other File... submenu
Quit
IDC
Immediate execution
Load... submenu
built-in
IDC
script file
File... submenu
notepad
Quick start
UI overview
Main Menu Bar
Toolbar
Navigation band
Status bar
Subviews
IDA view modes
Hex view
Pseudocode Window
Functions view
Activate a license
Download license
Activate a license
Download license
Activate a license
Activate a license

Invoke OS Shell

By using this command, you can temporarily quit to the operating system.

This command is not available in the MS DOS version.

The database is left open when you use this command, so be careful.

Check the overview of the IDA interface with menu and windows views and their corresponding options

Analize your binary and learn how to manipulate the disassembly output

Discover strategies for optimizing pseudocode

Learn how to take advantage of all debugger features and dynamic analysis

Check how to identify known code functions and standard libraries

Improve your work with collections of predefined data types

Personalize IDA to meet your needs—change themes, fonts, shortcuts and more

Get advantage of collaborative engineering work

Get fast function recognition with Lumina server

Learn how to install plugins and write your own

Check all utilities ready to extend IDA functionality

See also commands.

User Interface
Disassembler
Decompiler
Debugger
Signatures
Type Libraries
Configuration
Teams
Lumina
Plugins
Helper Tools
 Action    name: Shell
 
other File... submenu

Exit IDA

 Action    name: Quit
 

This command terminates the current IDA session. IDA will write all changes to the disk and will close all databases.

You can also perform garbage collection on the database before packing it. The garbage collection removes the unused database pages, making it smaller. However, IDA needs some free database pages when it works,therefore it will allocate them again when you reuse the database. Removing and adding free pages takes time and, what is most important, it changes the database control blocks.

Use garbage collection only when you do not intend to work with the database in the near future.

You can enable/disable database packing. When the database is packed, it consists of one file with IDB extension. When the database is not packed, it consists of several files on the disk. If packing is disabled, in the next session you cannot IDA. We do not recommend to leave the database in the unpacked form because you will not have a backup copy.

IDA will remember all information about the screen, cursor position, jump stack, etc. The following information will be lost: , the position To resume a disassembly session simply type: "ida file"

See also commands. command.

abort
keystroke macros
anchor
other File... submenu
Abort
install your IDA instance
install your IDA instance
install your IDA instance

Install IDA

By following the steps in this guide, you can successfully install your IDA instance on macOS, Linux, and Windows.

The installation steps are valid for all product versions: IDA Pro, IDA Home, or IDA Free.

This installation guide is dedicated to individual users.

Minimum system requirements

macOS 12 (Monterey) or later (x64 or ARM64)

x64 (x86_64) CentOS 7 or later, Ubuntu 16.04 or later. Other equivalent distributions may work but not guaranteed.

Windows 8 or later (x64)

Pre-installation steps

Installation on macOS

Prerequisites:

  • Make sure Python 3 or later is installed on your computer for the IDAPython API to function properly.

Step 1: Download the installer

Step 2: Run the installer

  • Extract the .zip archive.

  • Double-click on the extracted file to run the instalation wizard.

  • Follow the wizard's instructions to complete the installation:

    • accept the license agreement and installation directory;

    • copy your ida.hexlic file to IDA installation directory or to $HOME/.idapro directory before launching IDA.

Step 4: Launch IDA Pro for the first time

  • Double-click on the IDA Pro icon to launch the application.

Step 5: Point to your named/computer license

  • In the License manager pop-up window, specify the path of your license file and click OK.

You won't be asked about your license again unless the subscription period expires or you move your license file to a different location.


Installation on Linux

Prerequisites:

  • Make sure Python 3 or later is installed on your computer for the IDAPython API to function properly.

  • Verify that you have the required libraries installed. Use your package manager to install any missing dependencies. Common dependencies include libx11, libxext, libxrender, and libglib2.0.

Step 1: Download the installer

Step 4: Run the installer

  • Navigate to the directory containing your IDA installer, and make it executable.

  • Run the installer by double-click it or enter ./<your_IDA_version_>linux.run in the terminal to execute it.

  • Follow the wizard's instructions to complete the installation:

    • accept the license agreement and installation directory;

    • copy your ida.hexlic file to IDA installation directory or to $HOME/.idapro directory before launching IDA.

Step 5: Launch IDA Pro for the first time

  • Go to the directory where IDA is installad and run the command: ./ida90

Step 6: Point to your named/computer license

  • In the License manager pop-up window, specify the path of your license file and click OK.

You won't be asked about your license again unless the subscription period expires or you move your license file to a different location.


Installation on Windows

  • Make sure Python 3 or later is installed on your computer for the IDAPython API to function properly.

Step 1: Download the installer

Step 2: Run the installer

  • Locate the downloaded .exe file and double-click it to run the installer.

  • Follow the installation wizard's instructions to complete the installation:

    • accept the license agreement and installation directory;

    • copy your ida.hexlic file to IDA installation directory or to %APPDATA%/Hex-Rays/IDA Pro directory before launching IDA.

Step 5: Launch IDA Pro for the first time

  • Navigate to the Start Menu or desktop shortcut and launch IDA Pro.

Step 6: Point to your named/computer license

  • In the License Manager pop-up window, specify the path of your license file and click OK.

You won't be asked about your license again unless the subscription period expires or you move your license file to a different location.


Use floating license server

Step 1: In the License manager pop-up window, select the option Use floating license server and then type a license server hostname provided by your administrator.

Step 2: Borrow one of the licenses visible under the available licenses list and click OK.

Note that you don't need a license file stored on your machine locally while using floating licenses.


Common Post-Installation Steps

Step 1: Update IDA Pro

Step 2: Configure environment (optional)

Step 3: Install additional plugins (optional)

Save database

 Action    name: SaveBase
 

This command saves and packs the current database.

Activate your or license via My Hex-Rays portal.

Ensure that you have and downloaded your license file (ida.hexlic) locally.

Download the macOS version of IDA Pro from Download Center in portal.

The step below is valid for named and computer licenses for individual use. If you are going to use floating licenses, check alternative step.

License manager

Ensure that you have and downloaded your license file (ida.hexlic) locally.

Download the Linux version of IDA Pro from Download Center in portal.

The step below is valid for named and computer licenses for individual use. If you are going to use floating licenses, check alternative step.

Ensure that you have and downloaded your license file (ida.hexlic) locally.

Download the Windows version of IDA Pro from Download Center in portal .

The step below is valid for named and computer licenses for individual use. If you are going to use floating licenses, check alternative step.

After installation, check for any available updates. Hex-Rays often releases patches and updates for IDA Pro. You can check for updates within the application via Help -> Check for free update or download the latest version from portal.

Customize your IDA Pro environment settings to suit your preferences. This can include configuring hotkeys, and .

You can extend the functionality of IDA Pro by installing additional plugins that can be found on the official or other trusted sources in the reverse engineering community.

See also commands. command.

My Hex-Rays
My Hex-Rays
My Hex-Rays
My Hex-Rays
adjusting appearance settings
Hex-Rays repository
other File... submenu
Save database as...
named
computer
activated your computer/named license
activated your computer/named license
activated your computer/named license
this
this
this
Dump database to IDC file

Clear undo history

 Action    name: ResetUndo
 

This command clears the undo history. After it the Undo and Redo commands become unavailable. However, once the user performs a new action, IDA will again start journaling all database modifications.

A side effect of this command is fast autoanalysis: since there is no user action to revert yet, IDA does not maintain undo buffers and this speeds up the analysis.

See also

Produce output files

This submenu allows you to produce various output files. It also allows you to unload the database.

The text file-producing operations below will make use of

Create MAP File

 Action    name: ProduceMap
 

Please enter a file name for the map. IDA will write the following information about this file:

  - current segmentation
  - list of names sorted by values

You can use this map file for your information, and also for debugging (for example, Periscope from Periscope Company or Borland's Turbo Debugger can read this file).

Create ASM File

 Action    name: ProduceAsm
 

Please enter a file name for the assembler text file. IDA will write the disassembled text to this file.

If some I/O problem (e.g. disk full) occurs during writing to the file, IDA will stop and a partial file will be created.

Create INC File

 Action    name: ProduceInc
 

Please enter a file name for the assembler include file. IDA will write the information about the defined types (structures and enums) to this file.

If some I/O problem (e.g. disk full) occurs during writing to the file, IDA will stop and a partial file will be created.

Create LST File

 Action    name: ProduceLst
 

Enter a file name for the assembler listing file. IDA will write the disassembled text to this file.

If some I/O problem (e.g. disk full) occurs during writing to the file, IDA will stop and a partial file will be created.

Create Executable File

 Action    name: ProduceExe
 

IDA produces executable files only for:

  - MS DOS .exe
  - MS DOS .com
  - MS DOS .drv
  - MS DOS .sys
  - general binary
  - Intel Hex Object Format
  - MOS Technology Hex Object Format

EXE files: Output files will have the same EXE-header and relocation table as the input file. IDA will fill unused ranges of the EXE file (e.g. between relocation table and loadable pages) with zeroes.

Create Difference File

 Action    name: ProduceDiff
 

This command will prompt you for a filename and then will create a plain text difference file of the following format:

 comment

 filename
 offset: oldval  newval

Create HTML File

 Action    name: ProduceHtml
 

Please enter a file name for the HTML file. IDA will write the disassembled text to this file.

If some I/O problem (e.g. disk full) occurs during writing to the file, IDA will stop and a partial file will be created.

This command is available only in the graphical version of IDA.

Produce flow chart GDL file

 Action    name: ProduceFuncGdl
 

This command creates a GDL (graph description file) with the flow chart of the current function.

If there is an active selection, its flow chart will be generated.

IDA will ask for the output file name. Regardless of the specified extension, the .GDL extension will be used.

Produce call graph GDL file

 Action    name: ProduceCallGdl
 

This command creates a GDL (graph description file) with the graph of the function calls.

IDA will ask for the output file name. Regardless of the specified extension, the .GDL extension will be used.

Dump database to IDC file

 Action    name: DumpDatabase
 

This command saves current IDA database into a text file.

You can use it as a safety command:

  - to protect your work from disasters
  - to migrate information into new database formats of IDA.

This command is used when you want to switch to a new version of IDA. Usually each new version of IDA has its own database format. To create a new format database, you need:

  1. to issue the 'Dump...' command for the old
     database (using old version of IDA). You will
     get an IDC file containing all information
     from your old database.
  2. to reload your database using new IDA with switch -x.
  3. to compile and execute the IDC file with command
    'Execute IDC file' (usually F2)

Please note that this command does not save everything to text file. Any information about the local variables will be lost!

Create C header file

 Action    name: ProduceHeader
 

This command saves all definitions in the local types window into a C header file.

Dump typeinfo to IDC file

 Action    name: DumpTypes
 

This command saves information about the user-defined types from the IDA database into a text file.

Information about enums, structure types and other user-defined types is saved in a text form as an IDC program.

You can use this command to migrate the type definitions from one database to another.

Export data

Edit

This submenu allows the user to modify text representation and to patch the file. It also has the commands to control the analysis:

Undo an action

This command reverts the database to the state before executing the last user action. It is possible to apply Undo multiple times, in this case multiple user actions will be reverted.

Since there is a limit on the size of undo buffers, any action, even the tiniest, may become non-undoable after some time. This is true because the analysis or plugins may continue to modify the database and overflow the buffers. Some massive actions, like deleting a segment, may be non-undoable just because of the sheer amount of undo data they generate.

Please note that Undo does not affect the state of IDC or Python scripts. Script variables will not change their values because of Undo. Also nothing external to the database can be changed: created files will not be deleted, etc.

Some actions cannot be undone. For example, launching a debugger or resuming from a breakpoint cannot be undone.

See also

for output files.

You may disable the generation of the segmentation information. You may also enable or disable names in the output file.

If you have selected a range on the screen using command, IDA will write only the selected range (from the current address to the anchor).

If you've selected a range on the screen using command, IDA will write only the selected range (from the current address to the anchor).

Enter a file name for the new executable file. Usually this command is used after patching (see commands and ) to obtain a patched version of the file.

For other file formats please create a file.

Only commands affect the executable file contents, other commands (including ) will not affect the content of the disassembled file.

See also submenu.

See also submenu.

If you've selected a range on the screen using command, IDA will write only the selected range (from the current address to the anchor).

See also commands.

submenu

submenu

submenu

submenu

submenu

submenu

submenu

submenu

See also submenus.

Please note the entire database is reverted, including all modifications that were made to the database after executing the user action and including the ones that are not connected to the user action. For example, if a third party plugin modified the database during or after the user action, this modification will be reverted. In theory it is possible to go back in time to the very beginning and revert the database to the state state that was present immediately after performing the very first user action. However, in practice the undo buffers overflow because of the changes made by autoanalysis. generates copious amounts of undo data. Also please note that maintaining undo data during autoanalysis slows it down a bit. In practice it is not a big deal because the limit on the undo data is reached quite quickly (in a matter of minutes). Therefore, if during analysis the user does not perform any actions that modify the database, the undo feature will turn itself off temporarily.

However, if you prefer not to collect undo data at all during the initial autoanalysis, just turn off the UNDO_DURING_AA parameter in .

The configuration file has 2 more undo-related parameters:

Undo
Redo
Disable Undo
the currently-selected encoding
Drop Anchor
Drop Anchor
Edit|Patch core
Edit|Patch core
Drop Anchor
other File... submenu
Generate MAP file
Generate ASM file
Generate INC file
Generate LST file
Generate EXE file
Generate DIF file
Generate HTML file
Generate flow chart GDL file
Generate call graph GDL file
Dump database to IDC file
Dump typeinfo to IDC file
Create C header file
difference
  "Export data" dialog can export binary data into different formats.
 Action    name: Undo
 
  UNDO_MAXSIZE  max size of undo buffers; default: 128MB
                once this limit is reached, the undo info about the oldest
                user action will be forgotten.

  UNDO_DEPTH    max number of user actions to remember; default: 1000000
                if set to 0, the undo feature will be unavailable.
Anchor
Export data
Undo
Redo
Convert to instruction
Convert to data
Convert to STRLIT string
Convert to array
Undefine
Rename
Operand types
Comments
Functions
Structs
Segments
Patch program
Other
Plugins
Menu Bar
ida.cfg
ida.cfg
Redo
Reset Undo
Disable Undo

Redo an action

 Action    name: Redo
 

This command also reverts all changes that were done to the database after the last Undo command, including the eventual useful modifications made by the autoanalysis. In other words, the entire database is modified to get to the exact state that it had before executing the last Undo command.

See also

User-Specified String for the #th Operand

This command reverts the previously issued command. It is possible to use Redo multiple times.

Undo
Undo
Reset Undo
Disable Undo

Convert to instruction

 Action    name: MakeCode
 

This command converts the current unexplored bytes to instruction(s). IDA will warn you if it is not possible.

If you have selected a range using the [anchor](../../../disassembler/navigation/anchor.md, all the bytes from this range will be converted to instructions.

If you apply this command to an instruction, it will be reanalyzed.

Disable undo

 Action    name: DisableUndo
 

This command completely disables the undo feature.

See also

See also submenu

Edit
Undo
Redo
Reset Undo

Convert to data

 Action    name: MakeData
 

This command converts the current unexplored bytes to data. If it is not possible, IDA will warn you.

Multiple using of this command will change the data type:

 db -> dw -> dd -> float -> dq -> double -> dt -> packreal -> octa \;
 ^                                                                 |;
 \---------<----------------<--------------<-----------------------/;

You may remove some items from this list using command.

If the does not support double words or another data type, it will be skipped. To create a structure variable, use command. To create an array, use command. To convert back, use command. See also submenu

Array
Undefine
Edit

Convert to string literal

Convert to string literal

 Action    name: MakeStrlit
 

This command converts the current unexplored bytes to a string.

The GUI version allows you to assign a special hotkey to create Unicode strings. To do so, change the value of the StringUnicode parameter in the IDAGUI.CFG file.

Pascal Strings

The set of allowed characters is specified in the file, parameter StrlitChars. Character '\0' is not allowed in any case. If the current does not allow characters above 0x7F, characters with high bit set are not allowed.

If the has been dropped, IDA will take for the string all characters between the current cursor position and the anchor.

Use the if the string starts a disallowed character.

This command also generates a for the string. In the file, you can specify the characters allowed in names (NameChars).

You can change the literal string length using command.

To create Pascal style strings (with first byte indicating string length) use command.

See also submenu

anchor
anchor
name
configuration
Array
Edit
configuration

Undefine a byte

 Action    name: MakeUnknown
 

This command deletes the current instruction or data, converting it to 'unexplored' bytes. IDA will delete the subsequent instructions if there are no more references to them (functions are never deleted).

If you have selected a range using the , all the bytes in this range will be converted into 'unexplored' bytes. In this case, IDA will not delete any other instructions even if there are no references to them after the deletion.

See also submenu

anchor
Edit

Convert to array

 Action    name: MakeArray
 

This command allows you to create arrays and change their sizes.

The arrays are created in 2 simple steps:

  1. Apply the array command to the created data item. Enter array size in current array elements (not bytes). The suggested array size is the minimum of the following values:

         - the address of the next item with a cross reference
         - the address of the next user-defined name

For string literals, you can use this command to change the length of the string.

The dialog box contains the following fields:

Items on a line (meaningless for string literals):

        0               place maximal number of items on a line
        other value     number of items on a line

Alignment (meaningless for string literals):

        -1              do not align items
        0               align automatically
        other value     width of each item

 Signed elements:       if checked, IDA treats all elements as signed numbers.
                        only meaningful for numbers (not for offsets and
                        segments and strings)

 Display indexes:       if checked, IDA will display the indexes of array
                        elements in the form of comments (0,1,2...)

 Create as array:       if not checked, IDA will create a separate item for
                        each array element. Useful for creating huge arrays.
                        If the box is unchecked when this command is
                        applied to string literals, IDA will create many
                        string literals instead of one big string.

If applied to a variable-sized structure, this command is used to specify the overall size of the structure. You cannot create arrays of variable-sized structures.

See also:

Create the first element of array using the data definition commands (, , )

Please note that the parameter affects the number of items on a line too.

submenu

.

Edit
How to Enter a Number
data
string

Operand types

This submenu allows you to change the operand types to offsets, numbers, chars, etc. Use it to make disassembled text more understandable.

If IDA suspects that an operand can be represented as something different from a plain number, it will mark the operand as "suspicious" and show it in red. Use these commands to delete marks.

Some of these commands can be applied to a selected range. Click to learn about the rules applied to such operations.

See also submenu.

Convert operand to offset
Convert operand to number
Convert operand to character
Convert operand to segment
Convert operand to enum
Convert operand to stack variable
Change operand sign
Bitwise negate operand
User-defined operand
Set operand type
here
Edit

Give Name to the Location

 Action    name: MakeName
 

To delete a name, simply give an empty name.

Local name

  The name is considered to be defined only in the current function.
  Please note that IDA does not check the uniqueness of the local names
  in the whole program. However, it does verify that the name is unique for the
  function.

Include in name list

Public name

  You can declare a name as a public (global) name. If the current
  assembler supports the "public" directive, IDA will use it.
  Otherwise, the publicness of the name will be displayed as a comment.

Autogenerated name

  An autogenerated name will appear in a different color.
  if the item is indefined, it will disappear automatically .

Weak name

  You can declare a name as a weak name. If the current
  assembler supports the "weak" directive, IDA will use it.
  Otherwise, the weakness of the name will be displayed as a comment.

Create name anyway

  If this flag is on, and if the specified name already exists,
  IDA will try to variate the specified name by appending a suffix to it.

This command gives name/renames/deletes for the current item.

If the current item is referenced, you cannot delete its name. Even if you try, IDA will generate a name.

Here you can also include/remove the name from the . If the name is hidden, you will not see it in .

See also submenu. . .

name
Edit
How to Enter an Identifier

Offset

Convert operand to offset (data segment)

 Action    name: OpOffset
 

This command converts the immediate operand of the current instruction/data to an offset from the current data segment (DS).

If current DS value is unknown (or equal 0xFFFF) IDA will warn you -- it will beep. In this case, you have to define DS register value for the current byte. The best way to do it is:

If you want to delete offset definition, you can use this command again - it works as trigger.

If the cursor is on the first operand (the cursor is before ',') then the first operand will be affected; otherwise, all other operands will be affected.

See also:

Convert operand to offset (code segment)

 Action    name: OpOffsetCs
 

This command converts the immediate operand of the current instruction/data to an offset from the current segment (CS).

If the cursor is on the first operand (the cursor is before ',') then the first operand will be affected; otherwise, all other operands will be affected.

See also:

Convert operand to offset (any segment)

 Action    name: OpAnyOffset
 

This command converts the immediate operand of the current instruction/data to an offset from any segment.

IDA will ask to choose a base segment for the offset.

If the cursor is on the first operand (the cursor is before ',') then the first operand will be affected; otherwise, all other operands will be affected.

See also:

Convert operand to offset (user-defined base)

Action    name: OpUserOffset

If the cursor is on the first operand (the cursor is before ',') then the first operand will be affected; otherwise, all other operands will be affected.

If the offset base is specified as 0xFFFFFFFF, then IDA will create "an automatic offset". Automatic offsets mean that the actual value of the base will be calculated by IDA.

The following offset attributes are available:

  Treat the base address as a plain number

        if checked, IDA will treat the base address as a number.
        In this case, IDA will not create a cross-reference to it
        and the base address will be printed as a number,
        not as an offset expression.

  Offset points past the main object

        Offsets of this type point past an object end.
        They do not cause an object created/deletion.

  Use image base as offset base

        These offsets are based on the image base.
        There is no need to explicitly specify the offset base.
        These offsets are displayed in a concise form:
          rva func
        instead of
          offset func - imagebase
        If you intend to reassemble the output file, execute the
        following IDC statement:
        set_inf_attr(INF_GENFLAGS, get_inf_attr(INF_GENFLAGS) & ~INFFL_ALLASM);

  Subtract operand value

        Use this option when the operand value should be substracted
        from the base to get the target address. In this case the displayed
        expression will be displayed as
          offset base - target
        instead of the usual
          offset target - base

  Signed operand

        Use this option if the operand should be interpreted
        as a signed value. This option is only available for OFF_REF8,
        OFF_REF16, OFF_REF32 and OFF_REF64 offset types.

  Operand value of 0 is invalid

        If the operand value is 0, the value will be highlighted in red.

  Operand value of NOT 0 is invalid

        If the operand value is zero's complement (i.e. all bits are set),
        the value will be highlighted in red.
        For example a OFF_REF16 with an operand value of 0xFFFF would be invalid.

  Use the current address as the offset base

The offset base is dynamically calculated and is equal to the address of the current element:

  • for standalone items: their start address

  • for arrays: the start of the array element

See also:

Convert operand to structure offset

 Action    name: OpStructOffset
 

 GUI version:
 ------------

This command permits to convert all immediate operands of instructions in a range selection to a path of offsets through a structure and its possible sub unions. If no selection is active, IDA will simply permit to convert the current operand. In this case, it will display a simple dialog box the same way as the text version (see below).

You can select the desired register in the drop-down list: all operands relative to this register will be added to the 'Offsets' list. A special empty line in the drop-down list is used to directly work on immediate values. Checkboxes in the 'Offsets' list allow you to select which operand you indeed want to modify. By default, IDA will select only undefined operands, to avoid overwriting previous type definitions. This list is sorted by operand value, by instruction address and finally by operand number. You can easily see the instructions related to the operand by moving the mouse over it, and wait for a hint to be displayed.

The 'Structures and Unions' tree will contain all selectable structures, and sub unions. Once you select or move over a structure, the 'Offsets' list updates itself for each checked offset: the computed name of the operand is displayed, according to the selected structure in the tree. An icon is also drawn, to easily know if a specific structure matchs the offset or not, or if the offset is too big for the selected structure. The structures who match the most offsets will be near the top of the tree. You can also move your mouse over structures in the tree to obtain an interesting hint.

A '?' icon can also appear, if the offset can be specialized by selecting an union member. In this case, if you expand the structure in the tree, you can select the adequate union member simply by checking the desired radio button. IDA automatically corrects the related name in the 'Offsets' list.

The 'Offset delta' value represents the difference between the structure start and the pointer value. For example, if you have an operand 4 and want to convert in into an expression like "mystruct.field_6-2", then you have to enter 2 as the delta. Usually the delta is zero, i.e. the pointer points to the start of the structure.

The 'Hide sub structures without sub unions' option (checked by default) avoids to add unnecessary sub structures to the tree, to keep it as small as possible. If you uncheck this option, all sub structures will be added to the tree.

 Text version:
 -------------

First of all, IDA will ask a so-called "struct offset delta". This value represents the difference between the structure start and the pointer value. For example, if you have an operand 4 and want to convert in into an expression like "mystruct.field_6-2", then you have to enter 2 as the delta. Usually the delta is zero, i.e. the pointer points to the start of the structure.

If the cursor is on the first operand (the cursor is before ',') then the first operand will be affected; otherwise, all other operands will be affected.

See also:

or you can of DS for the current segment.

If a range is selected using the , IDA will perform 'en masse' conversion. It will convert immediate operands of all instructions in the selected range to offsets. However, IDA will ask you first the lower and upper limits of immediate operand value. If the operand value is >= lower limit and <= upper limit then the operand will be converted to offset, otherwise it will be left unmodified.

To create offsets to structure members use command.

command.

If a range is selected using the , IDA will perform 'en masse' conversion. It will convert immediate operands of all instructions in the selected range to offsets. However, IDA will ask you first the lower and upper limits of immediate operand value. If the operand value is >= lower limit and <= upper limit then the operand will be converted to offset, otherwise, it will be left unmodified.

If this command is applied to a structure member in the , then IDA will create an "automatic offset". An automatic offset is an offset with the base equal to 0xFFFFFFFF. This base value means that the actual value of the base will be calculated by IDA when a structure instance is created.

To create offsets to structure members, use command.

commands.

If a range is selected using the , IDA will perform 'en masse' conversion. It will convert immediate operands of all instructions in the selected range to offsets. However, IDA will ask you first the lower and upper limits of immediate operand value. If the operand value is >= lower limit and <= upper limit then the operand will be converted to offset, otherwise it will be left unmodified.

To create offsets to structure members use command.

commands.

for structures: the start of the structure field The offset expression is displayed in the following concise form: offset target - $ where "$" denotes the start of the element (and is -dependent). To create offsets to structure members use command.

commands.

By default, IDA displays the structure member at offset 0. To change this behaviour, you can directly disable the 'Force zero offset field' in the 'Options' frame. Later zero offsets can be forced using menu item.

This command converts immediate operand(s) type of the current instruction/data to an offset within the specified structure. Before using this command, you have to a structure type.

If a range is selected using the , IDA will perform 'en masse' conversion. It will convert immediate operands of all instructions in the selected range to offsets. However, IDA will ask you first the lower and upper limits of immediate operand value. If the an operand value is >= lower limit and <= upper limit then the operand will be converted to offset, otherwise it will be left unmodified.

When you use this command, IDA deletes the entered operand.

By default IDA doesn't display the structure member at offset 0. To change this behaviour, use command.

Moreover, if there are several possible representations (this can happen if unions are used), select the desired representation using the command.

command.

Related topics: submenu.

anchor
Enter the operand manually
Set operand type
anchor
Enter #th operand manually
Set operand type
anchor
Enter #th operand manually
Set operand type
Enter #th operand manually
Set operand type
anchor
manually
Enter #th operand manually
Set operand type
Edit|Operand types
Convert operand to offset (data segment)
Convert operand to offset (code segment)
Convert operand to offset (any segment)
Convert operand to offset (user-defined base)
Convert operand to struct offset
Convert to struct offset
Convert to struct offset
Convert to struct offset

Number

Convert operand to number

 Action    name: OpNumber
 

The number is represented in the default radix for the current processor (usually hex, but octal for PDP-11, for example).

If the cursor is on the first operand (the cursor is before ',') then the first operand will be affected; otherwise, all other operands will be affected.

Convert operand to hexadecimal number

 Action    name: OpHex
 

If the cursor is on the first operand (the cursor is before ',') then the first operand will be affected; otherwise, all other operands will be affected.

Convert operand to decimal number

 Action    name: OpDecimal
 

This command converts the immediate operand(s) type of the current instruction/data to decimal. Therefore, it becomes a 'number'.

If the cursor is on the first operand (the cursor is before ',') then the first operand will be affected; otherwise, all other operands will be affected.

Convert operand to octal number

 Action    name: OpOctal
 

This command makes the current instruction or data operand type octal. IDA always uses 123o notation for octal numbers even if the current assembler does not support octal numbers.

If the cursor is on the first operand (the cursor is before ',') then the first operand will be affected; otherwise, all other operands will be affected.

Convert operand to binary number

 Action    name: OpBinary
 

This command makes the current instruction or data operand type binary. IDA always uses 123b notation for binary numbers even if the current assembler does not support binary numbers.

If the cursor is on the first operand (the cursor is before ',') then the first operand will be affected; otherwise, all other operands will be affected.

Convert operand to floating point number

 Action    name: OpFloat
 

This command makes the current operand type floating point.

If the cursor is on the first operand (the cursor is before ',') then the first operand will be affected; otherwise, all other operands will be affected.

Toggle leading zeroes

 Action    name: ToggleLeadingZeroes
 

This command displays or hides the leading zeroes of the current operand. Example: if the instruction looked like this:

        and     ecx, 40h

then after applying the command it will look like this:

        and     ecx, 00000040h

Perform en masse operation

If you have selected a range before applying an operand conversion command, IDA will display a dialog box.

You can choose a range of operands to perform an en masse operation:

The operation will be performed on all operands as a toggle. For example, if you ask to convert to a character, then all non-character operands will become characters, and all character operands will become non-chars.

This selection will convert all operands with the specified type to undefined operands. Example: all characters become non-characters.

This selection allows to convert all operands that do not have the specified type to the specified type. Example: all non-characters to characters.

This selection allows to convert all operands without any type to the specified type. Example: all operands with no type to characters.

IDA will check whether an operand can be represented with the specified type (as a character constant, for example), and perform type conversion only if the check is successful.

Convert to struct offset

This command converts immediate operand(s) type of the current instruction/data to a number. That way, you can delete mark of the item.

When you use this command, IDA deletes the entered operand.

This command converts immediate operand(s) type of the current instruction/data to hex number. So you can delete mark of the item.

When you use this command, IDA deletes the entered operand.

When you use this command, IDA deletes the entered operand.

When you use this command, IDA deletes the entered operand.

When you use this command, IDA deletes the entered operand.

When you use this command, IDA deletes the entered operand.

If you prefer to see leading zeroes in all cases, then open the and enter the following expression: (INF_GENFLAGS, get_inf_attr(INF_GENFLAGS) | INFFL_LZERO); This will toggle the default for the current database and all numbers without leading zeroes will become numbers with leading zeroes, and vice versa.

See also submenu.

The operation will be performed on the operands which contain immediate numbers in the specified range.

manually
manually
manually
manually
manually
manually
calculator
set_inf_attr
Edit|Operand types
Convert operand to number
Convert operand to hex number
Convert operand to decimal number
Convert operand to octal number
Convert operand to binary number
Convert operand to floating point number
Toggle leading zeroes
 ALL OPERANDS
 -----------
 OPERAND VALUE RANGE
 -------------------
 ... OPERANDS
 ------------
 NOT ... OPERANDS
 ---------------
 NOT TYPED OPERANDS
 -----------------
 APPLY ONLY IF POSSIBLE
 ---------------------

Convert operand to character

 Action    name: OpChar
 

This command converts immediate operand(s) type of the current instruction/data to character.

If the cursor is on the first operand (the cursor is before ',') then the first operand will be affected; otherwise, all other operands will be affected.

Convert operand to segment

 Action    name: OpSegment
 

This command converts the immediate operand(s) type of the current instruction/data to segment base. The segment bases are usually displayed like this:

        mov     ax, seg dseg

If IDA cannot find a segment whose base is equal to the operand value, it simply displays it as hex number.

If the cursor is on the first operand (the cursor is before ',') then the first operand will be affected; otherwise, all other operands will be affected.

Complex Offset Expression

A complex offset expression looks like

        offset target + delta - offset base

It is specified by:

        - type (OFF16, OFF32, LOW16, etc.)
        - base
        - optional target
        - optional delta from target

The relationship between these parameters is (the formula is given for full offsets):

        operand_value = target + delta - base

  or (the same relationship in a different form):

        target = operand_value - delta + base

You always have to specify the offset type and base. Usually, the delta is equal to zero. For the full offset type you may omit the offset target, which is recommended. In this case, IDA will calculate it automatically. However, if you specify the offset target, make sure that the relationship between the parameters still holds. For the half offset types, you have to specify the target because there is no way to calculate it.

The offset types:

  8-bit full offset            :
  16-bit full offset           :
  32-bit full offset           :

    The full offsets are regular offset expressions like

        offset label

    They can occupy 8, 16, or 32 bits.
    You have to specify the offset base for these offsets.

  low 8 bits of 16-bit offset  :

    Only the low 8 bits of the offset. IDA will represent them as

        (offset label) & 0xFF

  low 16 bits of 32-bit offset :

    Only the low 16 bits of the offset. IDA will represent them as

        (offset label) & 0xFFFF

  high 8 bits of 16-bit offset :

    Only the high 8 bits of the offset. IDA will represent them as

        offset label >> 8

  high 16 bits of 32-bit offset:

    Only the high 17 bits of the offset. IDA will represent them as

        offset label >> 16

When you use this command, IDA deletes the entered operand.

See also submenu.

When you use this command, IDA deletes the entered operand.

See also submenu.

See also

manually
Edit|Operand types
manually
Edit|Operand types
offset by any user-specified base

Convert operand to symbolic constant (enum)

 Action    name: OpEnum
 

If the selected enum is a bitfield, IDA will try to build a bitfield expression to represent the constant. Please note that for bitfields having multiple constants with the same value some expressions won't be possible.

If the cursor is on the first operand (the cursor is before ',') then the first operand will be affected; otherwise all other operands will be affected.

This command converts immediate operand(s) type of the current instruction/data to an enum member. Before using this command, you have to an enumeration type.

If a range is selected using the , IDA will perform 'en masse' conversion. It will convert immediate operands of all instructions in the selected range to symbolic constants. However, IDA will ask you first the lower and upper limits of immediate operand value. If the operand value is >= lower limit and <= upper limit then the operand will be converted to offset, otherwise it will be left unmodified.

When you use this command, IDA deletes the entered operand.

See also: submenu. commands.

anchor
manually
Edit|Operand types
Enter #th operand manually
Set operand type

Convert operand to stack variable

 Action    name: OpStackVariable
 

This command converts immediate operand(s) type of the current instruction to an offset to stack variables, i.e. a local variable or function argument in the stack.

If the cursor is on the first operand (the cursor is before ',') then the first operand will be affected; otherwise all other operands will be affected.

You need to stack variables before using this command.

If the current operand is based on the value of the stack pointer ([ESP+xxx]) and the SP value is traced incorrectly, then you need to correct SP value using command.

If a range is selected using the , IDA will perform 'en masse' conversion. It will convert immediate operands of all instructions in the selected range to stack variables. However, IDA will ask you first the lower and upper limits of immediate operand value. If the operand value is >= lower limit and <= upper limit then the operand will be converted to stack variable, otherwise it will be left unmodified.

When you use this command, IDA deletes the entered operand.

See also: submenu. commands.

change stack pointer
anchor
manually
Edit|Operand types
Enter #th operand manually

Change operand sign

 Action    name: ChangeSign
 

This command changes the sign of the current operand. Please note that not all operands can change their sign.

See also: submenu. commands.

Edit|Operand types
Enter #th operand manually
Set operand type

Bitwise negate operand

 Action    name: BitwiseNegate
 

This command bit-wisely negates the current operand. Please note that not all types of operands can be negated. It is not possible to negate and change of an operand simultaneously.

This command works only if the current supports the bitwise negation operation.

See also: submenu. commands.

sign
Edit|Operand types
Enter #th operand manually
Set operand type

User-defined operand

 Action    name: ManualOperand
 

You may specify any string instead of an operand if IDA does not represent the operand in the desired form. In this case, IDA will simply display the specified string in the instruction instead of the default operand.

The current operand (under the cursor) will be affected.

You can use this command not only with instructions but with data items too.

IDA proposes the previous manual operand as the default value in the input form.

To delete the manual operand and revert back to the default text, specify an empty string.

NOTE: A text offset reference is generated if you use a label in the program as the operand string. In other cases no cross-references are generated.

IDA automatically deletes manually entered operands when you change operand representation using operand submenu.

See also submenu.

types
Edit|Operand types

Set operand type

 Action    name: SetOpType
 

This command allows you to specify the type of the operand under the cursor.

The operand type must be entered as a C declaration. Currently IDA itself does not use the operand type information. However, it can be used by the Hex-Rays decompiler plugin. Setting operand type is most useful in case of indirect calls: the decompiler will use the type information to determine the input parameters to the call instead of guessing, which can make the decompiled code better.

An example of a type declaration:

        int (*func)(int param1, char param2);

To delete a type declaration, enter an empty string.

For details on possible calling conventions, see menu item description.

See also

Comments

This submenu allows you to manipulate different kinds of comments. Use them to make the disassembled text more understandable.

Create a regular comment

 Action    name: MakeComment
 

If you stand at the function start and your cursor is on a function name, IDA will ask you to enter a function comment.

If you stand at the segment start and your cursor is on a segment name, IDA will ask you to enter a segment comment.

Otherwise, this command allows you to enter a normal indented comment for the current item.

See also

Create a repeatable comment

 Action    name: MakeRptCmt
 

This command allows you to enter a repeatable comment. A repeatable comment will appear attached to the current item and all other items referencing it.

If you stand at the function start, IDA will ask you to enter a function comment.

Otherwise, this command allows you to enter a repeatable comment for the current item.

You cannot enter repeatable segment comments.

All items that refer to the current item will have this comment by default.

The repeatable comments may be used to describe subroutines, data items, etc., because all calls to the subroutine will have the repeatable comment.

Create additional comment lines

Action                 Name
 ------                 ----
 edit anterior lines    MakeExtraLineA
 edit posterior lines   MakeExtraLineB

If you want to enter multi-line comments or additional instructions, you can use this feature of IDA.

There are two kinds of extra lines: the ones generated before the instruction line and the ones generated after the instruction line.

Do not forget that the maximal number of lines for an item is 500.

IDA does not insert a comment symbol at the beginning of the lines.

If this command is issued in the , it allows you to change the comment of a structure/enum, or structure/enum member. If the cursor is on the structure/enum name, the structure/enum comment will be changed, otherwise the member comment will be changed.

You can show/hide all comments in .

How to use the

submenu,

If this command is issued in the , it allows you to change the comment of a structure/enum, or structure/enum member. If the cursor is on the structure/enum name, the structure/enum comment will be changed, otherwise the member comment will be changed.

Note that if you have defined both comment types ( and repeatable), the regular comment will be displayed for the current item and the repeatable comment will be displayed for all items that refer to the current item, if they do not have their own comments.

You can show/hide all comments in the .

You can show and hide repeatable comments in the .

See also "How to use the ".

See also "How to use the ".

Related topics: submenu.

notepad
notepad
notepad
Edit
Create a regular comment
Create repeatable comments
Create additional comment lines
Edit|Comments
Repeatable comments
regular
define
Define stack variables...
Set function/item type...
Set function/item type...
structs
Edit, Structs, Force zero offset
Force zero field offset
Select union member...
Patch byte
Patch word
Patch byte/word
change value of DS

Functions

This submenu allows you to manipulate functions in the disassembly:

Create Function

Action    name: MakeFunction
 

This command defines a new function in the disassembly text.

   - function start point is equal to the current cursor position;
   - function end point is calculated by IDA.

A function cannot contain references to undefined instructions. If a function has already been defined at the specified addresses, IDA will jump to its start address, showing you a warning message.

A function must start with an instruction.

Edit Function

 Action    name: EditFunction
 

If the current address does not belong to any function, IDA beeps.

This command allows you to change the function frame parameters too. You can change sizes of some parts of frame structure.

IDA considers the stack as the following structure:

      +------------------------------+
      | function arguments           |
      +------------------------------+
      | return address               |
      +------------------------------+
      | saved registers (SI,DI,etc)  |
      +------------------------------+  <- BP
      | local variables              |
      +------------------------------+  <- SP

For some processors or functions, BP may be equal to SP. In other words, it can point to the bottom of the stack frame.

"Purged bytes" specifies the number of bytes added to SP upon function return. This value will be used to calculate the SP changes at call sites (used in some calling conventions, such as __stdcall in Windows 32-bit programs.)

"BP equal to SP" means that the frame pointer points to the bottom of the stack. It is usually used for the processors which set up the stack frame with EBP and ESP both pointing to the bottom of the frame (for example MC6816, M32R).

If you press <Enter> even without changing any parameter,IDA will reanalyze the function.

Sometimes, EBP points to the middle of the stack frame. FPD (frame pointer delta) is used to handle such situations. FPD is the value substracted from the EBP before accessing variables. An example:

           push    ebp
           lea     ebp, [esp-78h]
           sub     esp, 588h
           push    ebx
           push    esi
           lea     eax, [ebp+74h]

      +------------------------------+
      | function arguments           |
      +------------------------------+
      | return address               |
      +------------------------------+
      | saved registers (SI,DI,etc)  |
      +------------------------------+  <- typical BP
      |                              |
      |                              |
      |                              |  <- actual BP
      | local variables              |
      |                              |
      |                              |
      |                              |
      +------------------------------+  <- SP

In our example, the saved registers area is empty (since EBP has been initialized before saving EBX and ESI). The difference between the 'typical BP' and 'actual BP' is 0x78 and this is the value of FPD.

After specifying FPD=0x78 the last instruction of the example becomes

           lea     eax, [ebp+78h+var_4]

where var_4 = -4

Most of the time, IDA calculates the FPD value automatically. If it fails, the user can specify the value manually.

If the value of the stack pointer is modified in an unpredictable way, (e.g. "and esp, -16"), then IDA marks the function as "fuzzy-sp".

If this command is invoked for an imported function, then a simplified dialog box will appear on the screen.

Function flags

The following flags can be set in function properties:

Does not return

Far function

Library func

Static func

Mark the function as static. Currently this flag is not used by IDA and is simply informational.

BP based frame

BP equal to SP

Frame pointer points to the bottom of the stack instead of at the beginning of the local variables area as is typical.

Fuzzy SP

Function changes SP by an unknown value, for example: and esp, 0FFFFFFF0h

Outlined code

The function is not a real function but a fragment of multiple functions' common instruction sequence extracted by the compiler as a code size optimization (sometimes called "code factoring"). During decompilation, body of the function will be expanded at the call site.

Append Function Tail

 Action    name: AppendFunctionTail
 

This command appends an arbitrary range of the program to a function definition. A range must be selected before applying this command. This range must not intersect with other function chunks (however, an existing tail can be added to multiple functions).

IDA will ask to select the parent function for the selection and will append the range to the function definition.

Remove Function Tail

 Action    name: RemoveFunctionTail
 

This command removes the function tail at the cursor from a function definition.

If there are several parent functions for the current function tail range, IDA will ask to select the parent function(s) to remove the tail from.

After the confirmation, the current function tail range will be removed from the selected function definition.

If the parent was the only owner of the current tail, then the tail will be destroyed. Otherwise it will still be present in the database. If the removed parent was the owner of the tail, then another function will be selected as the owner.

Delete Function

 Action    name: DelFunction
 

Deleting a function deletes only information about a function, such as information about stack variables, comments, function type, etc.

The instructions composing the function will remain intact.

Set Function End

 Action    name: FunctionEnd
 

This command changes the current or previous function bounds so that its end will be set at the cursor. If it is not possible, IDA beeps.

Edit the argument location

Allow to edit argument or return value location.

Stack Variables Window

 Action    name: OpenStackVariables
 

This command opens the stack variables window for the current function.

The stack variables are internally represented as a structure. This structure consists of two parts: local variables and function arguments.

You can modify stack variable definitions here: add/delete/define stack variables, enter comments for them.

Offsets at the line prefixes represent offsets from the frame pointer register (BP). The window indicator at the lower left corner of the window displays offsets from the stack pointer.

Esc closes this window.

Change Stack Pointer

Action    name: ChangeStackPointer
 

This command allows you to specify how the stack pointer (SP) is modified by the current instruction.

You will need to use this command only if IDA was not able to trace the value of the SP register. Usually IDA can handle it but in some special cases it fails. An example of such a situation is an indirect call of a function that purges its parameters from the stack. In this case, IDA has no information about the function and cannot properly trace the value of SP.

Please note that you need to specify the difference between the old and new values of SP.

The value of SP is used if the current function accesses local variables by [ESP+xxx] notation.

Rename register

 Action    name: RenameRegister
 

This command allows you to rename a processor general register to some meaningful name. While this is not used very often on IBM PCs, it is especially useful on RISC processors with lots of registers.

For example, a general register R9 is not very meaningful and a name like 'CurrentTime' is much better.

This command can be used to define a new register name as well as to remove it. Just move the cursor on the register name and press enter. If you enter the new register name as an empty string, then the definition will be deleted.

If you have selected a range before using this command, then the definition will be restricted to the selected range. But in any case, the definition cannot cross the function boundaries.

Set function/item type

 Action    name: SetType
 

This command allows you to specify the type of the current item.

If the cursor is located on a name, the type of the named item will be edited. Otherwise, the current function type (if there is a function) or the current item type (if it has a name) will be edited.

The function type must be entered as a C declaration. Hidden arguments (like 'this' pointer in C++) should be specified explicitly. IDA will use the type information to comment the disassembly with the information about function arguments. It can also be used by the Hex-Rays decompiler plugin for better decompilation.

Here is an example of a function declaration:

        int main(int argc, const char *argv[]);

To delete a type declaration, please enter an empty string.

IDA supports the user-defined calling convention. In this calling convention, the user can explicitly specify the locations of arguments and the return value. For example:

        int __usercall func@<ebx>(int x, int y@<esi>);

denotes a function with 2 arguments: the first argument is passed on the stack (IDA automatically calculates its offset) and the second argument is passed in the ESI register and the return value is stored in the EBX register. Stack locations can be specified explicitly:

        int __usercall runtime_memhash@<^12.4>(void *p@<^0.4>, int q@<^4.4>, int r@<^8.4>)

There is a restriction for a __usercall function type: all stack locations should be specified explicitly or all are automatically calculated by IDA. General rules for the user defined prototypes are:

  - the return value must be in a register.
    Exception: stack locations are accepted for the __golang and __usercall calling conventions.

  - if the return type is 'void', the return location must not be specified

  - if the argument location is not specified, it is assumed to be
    on the stack; consequent stack locations are allocated for such arguments

  - it is allowed to declare nested declarations, for example:
    int **__usercall func16@<eax>(int *(__usercall *x)@<ebx>
                                             (int, long@<ecx>, int)@<esi>);
    Here the pointer "x" is passed in the ESI register;
    The pointed function is a usercall function and expects its second
    argument in the ECX register, its return value is in the EBX register.
    The rule of thumb to apply in such complex cases is to specify the
    the registers just before the opening brace for the parameter list.

  - registers used for the location names must be valid for the current
    processor; some registers are unsupported (if the register name is
    generated on the fly, it is unsupported; inform us about such cases;
    we might improve the processor module if it is easy)

  - register pairs can be specified with a colon like <edx:eax>

The name used in the declaration is ignored by IDA.

If the default calling convention is __golang then explicit specification of stack offsets is permitted. For example:

  __attribute__((format(printf,2,3)))
  int myprnt(int id, const char *format, ...);

This declaration means that myprnt is a print-like function; the format string is the second argument and the variadic argument list starts at the third argument.

Below is the full list of attributes that can be handled by IDA. Please look up the details in the corresponding compiler help pages.

  packed        pack structure/union fields tightly, without gaps
  aligned       specify the alignment
  noreturn      declare as not returning function
  ms_struct     use microsoft layout for the structure/union
  format        possible formats: printf, scanf, strftime, strfmon

For data declarations, the following custom __attribute((annotate(X))) keywords have been added. The control the representation of numbers in the output:

__bin unsigned binary number

__oct unsigned octal number

__hex unsigned hexadecimal number

__dec signed decimal number

__sbin signed binary number

__soct signed octal number

__shex signed hexadecimal number

__udec unsigned decimal number

__float floating point

__char character

__segm segment name

__off offset expression (a simpler version of __offset)

__invsign inverted sign

__invbits inverted bitwise

__lzero add leading zeroes

The following additional keywords can be used in type declarations:

_BOOL1 a boolean type with explicit size specification (1 byte)

_BOOL2 a boolean type with explicit size specification (2 bytes)

_BOOL4 a boolean type with explicit size specification (4 bytes)

__int8 a integer with explicit size specification (1 byte)

__int16 a integer with explicit size specification (2 bytes)

__int32 a integer with explicit size specification (4 bytes)

__int64 a integer with explicit size specification (8 bytes)

__int128 a integer with explicit size specification (16 bytes)

_BYTE an unknown type; the only known info is its size: 1 byte

_WORD an unknown type; the only known info is its size: 2 bytes

_DWORD an unknown type; the only known info is its size: 4 bytes

_QWORD an unknown type; the only known info is its size: 8 bytes

_OWORD an unknown type; the only known info is its size: 16 bytes

_TBYTE 10-byte floating point value

_UNKNOWN no info is available

__pure pure function: always returns the same value and does not modify memory in a visible way

__noreturn function does not return

__usercall user-defined calling convention; see above

__userpurge user-defined calling convention; see above

__golang golang calling convention

__swiftcall swift calling convention

__spoils explicit spoiled-reg specification; see above

__hidden hidden function argument; this argument was hidden in the source code (e.g. 'this' argument in c++ methods is hidden)

__return_ptr pointer to return value; implies hidden

__struct_ptr was initially a structure value

__array_ptr was initially an array

__unused unused function argument __cppobj a c++ style struct; the struct layout depends on this keyword

__ptr32 explicit pointer size specification (32 bits)

__ptr64 explicit pointer size specification (64 bits)

__high high level prototype (does not explicitly specify hidden arguments like 'this', for example) this keyword may not be specified by the user but IDA may use it to describe high level prototypes

__bitmask a bitmask enum, a collection of bit groups

Shifted pointers

Sometimes in binary code we can encounter a pointer to the middle of a structure. Such pointers usually do not exist in the source code but an optimizing compiler may introduce them to make the code shorter or faster.

Such pointers can be described using shifted pointers. A shifted pointer is a regular pointer with additional information about the name of the parent structure and the offset from its beginning. For example:

        struct mystruct
        {
          char buf[16];
          int dummy;
          int value;            // <- myptr points here
          double fval;
        };
        int *__shifted(mystruct,20) myptr;

The above declaration means that myptr is a pointer to 'int' and if we decrement it by 20 bytes, we will end up at the beginning of 'mystruct'.

Please note that IDA does not limit parents of shifted pointers to structures. A shifted pointer after the adjustment may point to any type except 'void'.

Also, negative offsets are supported too. They mean that the pointer points to the memory before the structure.

When a shifted pointer is used with an adjustment, it will be displayed with the 'ADJ' helper function. For example, if we refer to the memory 4 bytes further, it can be represented like this:

        ADJ(myptr)->fval

Shifted pointers are an improvement compared to the CONTAINING_RECORD macro because expressions with them are shorter and easier to read.

Scattered argument locations

  00000000 struc_1         struc ; (sizeof=0xC)
  00000000 c1              db ?
  00000001                 db ? ; undefined
  00000002 s2              dw ?
  00000004 c3              db ?
  00000005                 db ? ; undefined
  00000006                 db ? ; undefined
  00000007                 db ? ; undefined
  00000008 i4              dd ?
  0000000C struc_1         ends

If we have this function prototype:

  void myfunc(struc_1 s);

the 64bit GNU compiler will pass the structure like this:

  RDI: c1, s2, and c3
  RSI: i4

Since compilers can use such complex calling conventions, IDA needs some mechanism to describe them. Scattered argument locations are used for that. The above calling convention can be described like this:

  void __usercall myfunc(struc_1 s@<0:rdi.1, 2:rdi^2.2, 4:rdi^4.1, 8:rsi.4>);

It reads:

  1 byte  at offset 0 of the argument is  passed in the byte 0 of RDI
  2 bytes at offset 2 of the argument are passed in the byte 1,2 of RDI
  1 byte  at offset 4 of the argument is  passed in the byte 3 of RDI
  4 bytes at offset 8 of the argument are passed starting from the byte 0 of RSI

In other words, the following syntax is used:

  argoff:register^regoff.size

where

  argoff - offset within the argument
  register - register name used to pass part of the argument
  regoff - offset within the register
  size - number of bytes

The regoff and size fields can be omitted if there is no ambiguity.

If the register is not specified, the expression describes a stack location:

  argoff:^stkoff.size

where

  argoff - offset within the argument
  stkoff - offset in the stack frame (the first stack argument is at offset 0)
  size - number of bytes

Please note that while IDA checks the argument location specifiers for soundness, it cannot perform all checks and some wrong locations may be accepted. In particular, IDA in general does not know the register sizes and accepts any offsets within them and any sizes.

Data representation: enum member

Syntax:

  __enum(enum_name)

Instead of a plain number, a symbolic constant from the specified enum will be used. The enum can be a regular enum or a bitmask enum. For bitmask enums, a bitwise combination of symbolic constants will be printed. If the value to print cannot be represented using the specified enum, it will be displayed in red.

Example:

   enum myenum { A=0, B=1, C=3 };
   short var __enum(myenum);

   If `var` is equal to 1, it will be represented as "B"

Another example:

   enum mybits __bitmask { INITED=1, STARTED=2, DONE=4 };
   short var __enum(mybits);

   If `var` is equal to 3, it will be represented as "INITED|STARTED"

This annotation is useful if the enum size is not equal to the variable size. Otherwise using the enum type for the declaration is better:

   myenum var;  // is 4 bytes, not 2 as above

Data representation: offset expression

Syntax:
  __offset(type, base, tdelta, target)
  __offset(type, base, tdelta)
  __offset(type, base)
  __offset(type|AUTO, tdelta)
  __offset(type)
  __off

where

type is one of:

  OFF8       8-bit full offset
  OFF16      16-bit full offset
  OFF32      32-bit full offset
  OFF64      64-bit full offset
  LOW8       low 8 bits of 16-bit offset
  LOW16      low 16 bits of 32-bit offset
  HIGH8      high 8 bits of 16-bit offset
  HIGH16     high 16 bits of 32-bit offset

The type can also be the name of a custom refinfo.

It can be combined with the following keywords:

  RVAOFF     based reference (rva)
  PASTEND    reference past an item
             it may point to an nonexistent address
  NOBASE     forbid the base xref creation
             implies that the base can be any value
             nb: base xrefs are created only if the offset base
             points to the middle of a segment
  SUBTRACT   the reference value is subtracted from the base value instead of
             (as usual) being added to it
  SIGNEDOP   the operand value is sign-extended (only supported for
             REF_OFF8/16/32/64)
  NO_ZEROS   an opval of 0 will be considered invalid
  NO_ONES    an opval of ~0 will be considered invalid
  SELFREF    the self-based reference

The base, target delta, and the target can be omitted. If the base is BADADDR, it can be omitted by combining the type with AUTO:

  __offset(type|AUTO, tdelta)

Zero based offsets without any additional attributes and having the size that corresponds the current application target (e.g. REF_OFF32 for a 32-bit bit application), the shoft __off form can be used.

Examples:

  A 64-bit offset based on the image base:

  int var __offset(OFF64|RVAOFF);

  A 32-bit offset based on 0 that may point to an non-existing address:

  int var __offset(OFF32|PASTEND|AUTO);

  A 32-bit offset based on 0x400000:

  int var __offset(OFF32, 0x400000);

  A simple zero based offset that matches the current application bitness:

  int var __off;

This annotation is useful the type of the pointed object is unknown or the variable size is different from the usual pointer size. Otherwise it is better to use a pointer:

  type *var;

Data representation: string

Syntax:

  __strlit(strtype, "encoding")
  __strlit(strtype, char1, char2, "encoding")
  __strlit(strtype)

where strtype is one of:

  C          Zero terminated string, 8 bits per symbol
  C_16       Zero terminated string, 16 bits per symbol
  C_32       Zero terminated string, 32 bits per symbol
  PASCAL     Pascal string: 1 byte length prefix, 8 bits per symbol
  PASCAL_16  Pascal string: 1 byte length prefix, 16 bits per symbol
  LEN2       Wide Pascal string: 2 byte length prefix, 8 bits per symbol
  LEN2_16    Wide Pascal string: 2 byte length prefix, 16 bits per symbol
  LEN4       Delphi string: 4 byte length prefix, 8 bits per symbol
  LEN4_16    Delphi string: 4 byte length prefix, 16 bits per symbol

It may be followed by two optional string termination characters (only for C). Finally, the string encoding may be specified, as the encoding name or "no_conversion" if the string encoding was not explicitly specified.

Example:

  A zero-terminated string in windows-1252 encoding:

  char array[10] __strlit(C,"windows-1252");

  A zero-terminated string in utf-8 encoding:

  char array[10] __strlit(C,"UTF-8");

Data representation: structure offset

Syntax:

  __stroff(structname)
  __stroff(structname, delta)

Instead of a plain number, the name of a struct or union member will be used. If delta is present, it will be subtracted from the value before converting it into a struct/union member name.

Example:

  An integer variable named `var` that hold an offset from the beginning of
  the `mystruct` structure:

  int var __stroff(mystruct);

  If mystruct is defined like this:

  struct mystruct
  {
    char a;
    char b;
    char c;
    char d;
  }

  The value 2 will be represented as `mystruct.c`

Another example:

  A structure offset with a delta:

  int var __stroff(mystruct, 1);

  The value 2 will be represented as `mystruct.d-1`

Data representation: custom data type and format

Syntax:

 __custom(dtid, fid)

where dtid is the name of a custom data type and fid is the name of a custom data format. The custom type and format must be registered by a plugin beforehand, at the database opening time. Otherwise, custom data type and format ids will be displayed instead of names.

Data representation: tabular form

Syntax:

  __tabform(flags)
  __tabform(flags,lineitems)
  __tabform(flags,lineitems,alignment)
  __tabform(,lineitems,alignment)
  __tabform(,,alignment)

This keyword is used to format arrays. The following flags are accepted:

  NODUPS do not use the `dup` keyword
  HEX    use hexadecimal numbers to show array indexes
  OCT    use octal numbers to show array indexes
  BIN    use binary numbers to show array indexes
  DEC    use decimal numbers to show array indexes

It is possible to combine NODUPS with the index radix: NODUPS|HEX

Example:

  Display the array in tabular form, 4 decimal numbers on a line, each number
  taking 8 positions. Display indexes as comments in hexadecimal:

  char array[16] __tabform(HEX,4,8) __dec;

  A possible array may look like:

  dd   50462976, 117835012, 185207048, 252579084; 0
  dd  319951120, 387323156, 454695192, 522067228; 4
  dd  589439264, 656811300, 724183336, 791555372; 8
  dd  858927408, 926299444, 993671480,1061043516; 0Ch

Without this annotation, the `dup` keyword is permitted, number of items on a line and the alignment are not defined.

Rename Any Address

 Action    name: MakeAnyName
 

To delete a name, simply give an empty name.

Structs

This submenu allows you to manipulate the structures in specific operations. The following commands are accessible from the disassembly window.

Commands for creating, editing, and deleting the structures are available from the Local Types window.

Use regular commands to specify struct and union members, their types, comments, etc.

A union is a special kind of structure. Use structure definition commands to manipulate unions.

Declare a structure variable

 Action    name: MakeStructVar
 

This command declares a variable of the specified structure type.

You can also use this command to declare a structure field in another structure (i.e. nested structures are supported too).

Force zero field offset

 Action    name: ZeroStructOffset
 

This command forces IDA to display a full structure member name even if the offset of the member is equal to zero.

If used twice, the command cancels itself.

Example: Suppose we have the following structure:

        xxx     struc
        a       db ?
        b       db ?
        c       db ?
        xxx     ends

        dloc    xxx ?

  Normally IDA displays references to it like this:

        mov     eax, offset dloc
        mov     eax, offset dloc.b

  If you force IDA, then it displays member 'a':

        mov     eax, offset dloc.a
        mov     eax, offset dloc.b

Select union member

 Action    name: SelectUnionMember
 

This command tells IDA how to display references to a union from the current cursor location.

Example: Suppose we have the following union:

        xxx     union
        a       db ?
        b       dw ?
        c       dd ?
        ends   xxx

        dloc    xxx ?

  Normally, IDA displays references to "dloc" like this:

        mov     al,  byte ptr dloc
        mov     eax, word ptr dloc

  After using this command, IDA can display the union members:

        mov     al,  dloc.b
        mov     eax, dloc.d

Create a new structure from current data

Action    name: CreateStructFromData
 

This command defines a new structure from data already defined. The new structure is created with adequate data types, and each member uses the current data name if it is available.

This command is available only in the graphical version of IDA.

Copy field info to pointers

 Action    name: CopyFieldsToPointers
 

This command scans the current struct variable and renames the locations pointed by offset expressions unless they already have a non-dummy name.

It also copies the type info from the struct members to pointed locations.

Patch core

This submenu allows you to patch the image of the input file. More precisely, IDA never modifies the input file. The image of the input file which was loaded to the database will be modified.

You can modify the image of the input file:

        - change a byte
        - change a word
        - enter an assembler instruction (only for IBM PC)

IDA will display the original value, the current value and file offset. If the file offset is equal to 0xFFFFFFFF then the current byte comes from a compressed page (LX/LE/NE iterated pages, for example) and/or it is not possible to tell the file position.

The following commands are available:

See also:

Patching the Image

Action    name: PatchByte, PatchWord
 

If this command is invoked when the debugger is active, then IDA will modify the memory and the database. If the database does not contain the patched bytes, then only the process memory will be modified.

Apply patches to input file

Action    name: ApplyPatches
 

Apply previously patched bytes back to the input file. If the "Restore" option is selected then the original bytes will be applied to the input file.

Binary string format

It is possible to enter a sequence of the following items:

  - a number in the selected radix (hexadecimal, decimal or octal)
  - a string constant: "string"
  - a Unicode string constant: L"unicode string"
  - a question mark '?' to ignore variable bytes

The sequence must be separated by a space or a comma.

An entered number will occupy the minimal number of bytes it fits in with the restriction that the number of bytes is a power of 2 (1, 2, or 4 bytes).

Two question marks without a space between them are the same as one question mark. One question mark corresponds to one CPU byte. One CPU byte may consist of multiple octets for a wide-byte CPU, like TMS320C28.

Example:

  CD 21          - bytes 0xCD, 0x21
  21CD           - bytes 0xCD, 0x21 (the order depends on the endiannes)
  "Hello", 0     - the null terminated string "Hello"
  L"Hello"       - 'H', 0, 'e', 0, 'l', 0, 'l', 0, 'o', 0
  B8 ? ? ? ? 90  - byte 0xB8, 4 bytes with any value, byte 0x90

Assemble an instruction

Action    name: Assemble
 

This command allows you to assemble instructions. Currently, only the IBM PC processors provide an assembler, nonetheless, plugin writers can extend or totally replace the built-in assembler by writing their own.

The assembler requires to enclose all memory references into square brackets. For example:

        mov ax, [counter]

Also, the keyword 'offset' must not be used. Instead of

        mov eax, offset name

you must write

        mov eax, name

Segments

This submenu allows you to manipulate segments of the program:

See also:

Create a new segment

Action    name: CreateSegment
 

This command allows you to create a new segment.

You need to specify at least:

    - the segment start address
    - the segment end address (excluded from the range)
    - the segment base

If another segment already exists at the specified address, the existing segment is truncated and the new segment lasts from the specified start address to the next segment (or specified end address, whichever is lower). If the old and the new segments have the same base address, instructions/data will not be discarded by IDA. Otherwise, IDA will discard all instructions/data of the new segment.

An additional segment may be created by IDA to cover the range after the end of the new segment.

IDA address space concepts

nternally, IDA has 32-bit linear address space (IDA64 uses 64-bit address space). The internal addresses are called "linear addresses". The input program is loaded into this linear address space.

Please note that usually the linear addresses are not used in the program directly. During disassembling, we use so-called "virtual addresses", which are calculated by the following formula:

        VirtualAddress = LinearAddress - (SegmentBase << 4);

We see that the SegmentBase determines what addresses will be displayed on the screen. More than that, IDA allows to create several segments with the same virtual address in them. For this, you just need to create segments with correct segment base values.

There are some address restrictions in IDA.

There is a range of addresses that are used for internal housekeeping. This range can be specified by the configuration variable PRIVRANGE (start address and size). It is not recommended to use these addresses for other purposes.

There is also one address which must never be used in the disassembly. It is the 'all ones' address, or -1. Internally, it is used as a BADADDR (bad address). No address or address range can include BADADDR.

Related topics:

Create segment - simple case (PC)

IBM PC case -----------

Suppose we need to create a segment occupying addresses F000:1000..F000:2000 Let's calculate linear addresses:

        start = (0xF000 << 4) + 0x1000 = 0xF1000
        end   = (0xF000 << 4) + 0x2000 = 0xF2000

The segment base must be selected so that the first offset in our segment will be 0x1000. Let's find it using the following equation:

        VirtualAddress = LinearAddress - (SegmentBase << 4);
        0x1000         = 0xF1000 - (base << 4);

After solving this equation, we see that the segment base is equal to 0xF000. (you see, this is really a very simple case :) )

Now, we can create a segment entering:

        segment start address:  0xF1000
        segment end address:    0xF2000
        segment base:           0xF000

Please note that the end address never belongs to the segment in IDA.

Create segment - simple case (Z80)

Z80 case
 --------

Suppose we need to create a segment occupying virtual addresses 8000-C000. Since we are free to place our segment anywhere in the linear address space, we choose the linear addresses at our convenience. Let's say we choose a linear address 0x20000:

        start = 0x20000
        end   = start + 0x4000 = 0x24000

The segment base must be selected so that the virtual address in our segment will be 0x8000. Let's find it using the following equation:

        VirtualAddress = LinearAddress - (SegmentBase << 4);
        0x8000         = 0x20000 - (base << 4);
        base << 4      = 0x20000 - 0x8000
        base << 4      = 0x18000
        base           = 0x1800

After solving this equation, we see that the segment base is equal to 0x1800.

Now we can create a segment entering:

        segment start address:  0x20000
        segment end address:    0x24000
        segment base:           0x1800

Please note that the end address never belongs to the segment in IDA.

Create segment - automatically chosen selector case

Suppose we need to create a segment occupying linear addresses 200000-200C00 and the virtual addresses must have be 0000..0C00. If we simply enter

        segment start address:  0x200000
        segment end address:    0x200C00
        segment base:           0x20000

Then IDA will notice that the segment base is too big and does not fit into 16bits. Because of this IDA will find a free selector (let's say it has found selector number 5), define it to point at paragraph 0x20000 and create a segment. After all this we will have:

        - a new selector is defined (5 -> 0x20000)
        - a new segment is created. Its attributes:
                start = 0x200000
                end   = 0x200C00
                base  = 5

The first virtual address in the segment will be 0:

        VirtualAddress = LinearAddress - (SelectorValue(SegmentBase) << 4)
                       = 0x200000      - (SelectorValue(5) << 4)
                       = 0x200000      - (0x20000 << 4)
                       = 0x200000      - 0x200000
                       = 0

Please note that the end address never belongs to the segment in IDA.

Create segment - user-defined selector case

2. Create a segment. Specify the selector number as the segment base.

Delete a segment

Action    name: KillSegment
 

This command allows you to delete a segment.

IDA will ask your the permission to disable the addresses occupied by the segment. If you allow this operation, all information about the segment will be deleted. In other words, IDA will discard the information about instructions or data, comments etc.

If you check the "disable addresses" checkbox, IDA will mark the addresses occupied by the segment as "nonexistent" in the program. You will lose *ALL* information, including byte values.

It is impossible to disassemble the content of addresses not located in any segment, therefore you must create a new segment if you want to resume the disassembly of that part of the code.

IDA will ask your the permission to disable addresses occupied by the segment. If you give your permission, information about the segment will be deleted, otherwise IDA will discard information about instruction/data, comments etc, but retain byte values so that you will be able to create another segment afterwards.

Change segment attributes

Changing the segment class may change the segment type.

DISABLE ADDRESSES: if set, when a segment is shrunk, all information about bytes going out of the segment will be completely removed.. Otherwise, IDA will discard information about instructions/data, comments etc, but will retain byte values so that another segment can be created later and it will use the existing byte values.

If IDA creates 2 segments where only one segment must exist, you may try the following sequence:

Segments with the 'debugger' attribute are the segments whose memory contents are not saved in the database. Usually, these segments are created by the debugger to reflect the current memory state of the program.

However, the user can modify this attribute.

If it is cleared, then the segment will permanently stay in the database after closing the debugger session. The database will reflect the state of the segment which was at the time when the status is changed.

If it is set, then the segment will become a temporary segment and will be deleted at the end of the debugging session.

The "debugger segment" checbkox is available only during debugging sessions.

The 'loader' segments are the segment created by the file loader. The segment having this attribute are considered to be part of the input file.

A segment with the 'debugger' attribute set and the 'loader' attribute not set is considered to be an ephemeral segment. Such segments are not analyzed automatically by IDA.

"Segment permissions" group box can be used to modify Segment access permissions (Read/Write/Execute)

Change Segment Name

Enter a new name for the segment. A segment name is up to 8 characters long. IDA does check if the length is ok. Try to give mnemonic names for the segments.

Segment Class Name

The segment class name identifies the segment with a class name (such as CODE, FAR_DATA, or STACK). The linker places segments with the same class name into a contiguous range of memory in the runtime memory map.

Changing the segment class changes only the segment definition on the screen. There are the following predefined segment class names:

        CODE    -       Pure code
        DATA    -       Pure data
        CONST   -       Pure data
        BSS     -       Uninitialized data
        STACK   -       Uninitialized data
        XTRN    -       Extern definitions segment

If you change segment class and the segment type is "Regular", then the segment type will be changed accordingly.

In order to set the segment type "Regular", you should change the segment class to "UNK".

Segment class names are never deleted. Once you define a segment class name, you cannot reuse it as a name of another object.

Change Segment Addressing

You can choose between 16-bit and 32-bit segment addressing.

IDA will delete all instructions and data in the segment if the segment address is changed.

Never do it if you are not sure. It may have irreversible consequences, all instructions/data will be converted to undefined bytes.

Change Segment Alignment

Alignment: select between abs,byte,word,dword,para,page

You can specify the segment alignment for the selected segment. By default, IDA assumes 'byte' alignment.

Changing the alignment changes only the segment definition on the screen. Nothing else will happen.

Change Segment Combination

Combination

A field that describes how the linker can combine the segment with other segments. Under MS-DOS, segments with the same name and class can be combined in two ways: they can be concatenated to form one logical segment, or they can be overlapped. In the latter case, they have either the same start address or the same end address, and they describe a common range in memory. Values for the field are:

  Private. Do not combine with any
           other program segment.
  Public.  Combine by appending at
           an offset that meets the
           alignment requirement.

  Stack.   Combine as for Public.
           This combine type forces
           byte alignment.

  Common.  Combine by overlay using
           maximum size.

Changing segment combination changes only the segment definition on the screen. Nothing else will happen.

Move a segment

Action    name: MoveSegment
 

This command allows you to move segment(s) to another address. Use it if the segment(s) are loaded at a wrong address.

This command shifts (moves) the selected segments in the memory to the target address. There must be enough free space at the target address for the segments.

All information in the segment will be moved to the new address, but since the addresses change, the disassembly might be not valid anymore (especially if the program is moved to the wrong addresses and the relocation information is not available).

 Fix up relocations

        This option allows IDA to modify the references
        to/from the relocated segment(s). If it is turned
        off, the references might be wrong after the move.

Rebase program

Action    name: Rebase program
 

The whole program will be shifted by the specified amount of bytes in the memory. The following options are available (we strongly recommend to leave them turned on):

 Fix up relocations

        This option allows IDA to modify the references
        to/from the relocated segment(s). If it is turned
        off, the references might be wrong after the move.

 Rebase the whole image

        This option is accessible only if the whole program
        is selected. It allows IDA to adjust internal
        variables on the whole program.

Please note rebasing the program might remove user-defined xrefs.

Change segment translation

        call    1000

in the segment C obviously refers to the segment B while the instruction

        call    500

refers to the segment A.

However, IDA does not try to link these references unless you tell it to do so: include the segments A and B into a translation list of the segment C. It means that you have to create a translation list

        A B

for the segment C.

Below is a more complicated example:

                start   end
        A       0000    1000
        B       1000    2000
        C       1000    2000
        D       3000    4000
        E       3000    4000

translations

        B:      A
        C:      A
        D:      A B
        E:      A C

allow you to emulate overlays (the first set is A B D, the second A C E)

See also

Set Default Segment Register Value

Action    name: SetSegmentRegisterDefault
 

Relevant only for processors with the segment registers.

You can specify a default value of a segment register for the current segment. When you change the default value, IDA will reanalyze the segment, taking the default value when it cannot determine the actual value of the register. This takes time, so do not be surprised if references are not corrected immediately.

Change Segment Register Value

 Action    name: SetSegmentRegister
 

Relevant only for processors with the segment registers. Currently this command works for IBM PC, TMS320C2, Intel80196, and PowerPC processors.

ALPHA DISASSEMBLY

For Alpha processors, the user must enter the difference between the real GP value and the start of the GOT (global offset table). For example:

         .got
         ....
         ; gp points here
 label:

If you want to specify that a register points to "label", you must calculate and enter the difference "label-.got" as the register value.

ARM DISASSEMBLY

The ARM processor module has a virtual segment register T which reflects the state of the T bit of the processor state register (PSR). Therefore, the value of this register controls THUMB/ARM mode. If its value is not zero, then the disassembly will be in the thumb mode.

POWER PC DISASSEMBLY

For PowerPC processors, the user must enter an offset from the beginning of the TOC to the TOC entry which contains the address of the target. An example:

 TOC:    .toc
         ....
 sometc: .tc sometc[tc], datachunk

If you want to specify that a register points to "datachunk", you must calculate and enter the difference "sometc-TOC" as the register value. You can change the TOC value in the processor specific options (which is accessible from the analysis options).

INTEL 80196 DISASSEMBLY

For Intel 80196NP/NU processors, the user must enter the value of WSR or WSR1 register. IDA will automatically take the new value into account.

See also:

Segment Register Change Points

IDA classifies the change points. In the list of the change points, you can see the following postfixes after the register values:

 a (auto)     - Created by IDA. May be changed by IDA afterwards.
 u (by user)  - Created by user. IDA will not change it.

Choose segment

IDA can display a list of the program segments. Each segment is represented by a line in the list. Please note that the end address of the segment never belongs to the segment in IDA.

The following segment attributes are visible:

  Name          Segment name
  Start         Virtual start address
  End           Virtual end address (address past the end of the segment)
  R             'R': readable,      '.': not readable,   '?':unknown
  W             'W': writable,      '.': not writable,   '?':unknown
  X             'X': executable,    '.': not executable, '?':unknown
  D             'D': debugger only, '.': regular
  L             'L': created by loader, '.': no
  Align         Segment alignment
  Base          Segment base selector or address
  Type          Segment type
  Class         Segment class
  AD            Segment addressing width

The rest of the columns display the default values of the segment registers for the segment.

By default, the cursor is located on the current segment.

You can use normal cursor movement keys and the mouse. You can also search for the segment by pressing Alt-T, or directly jump to the desired line by typing in its number.

Press <Enter> to select line, <Esc> to cancel the selection.

Other

Create alignment directive

Action    name: MakeAlignment
 

This command allows you to create an alignment directive. The alignment directive will replace a number of useless bytes inserted by the linker to align code and data to paragraph boundary or any other address which is equal to a power of two.

You can select a range to be converted to an alignment directive. If you have selected a range, IDA will try to determine a correct alignment automatically.

There are at least two requirements for this command to work:

  • there must be enough unexplored bytes at the current address.

  • an alignment directive must always end at an address which is divisible by a power or two.

See also

Specify instruction representation manually

Action    name: ManualInstruction
 

This command allows you to specify the representation of an instruction or data in the program.

To delete the manual representation, specify an empty string.

Specify instruction color

Action    name: ColorInstruction
 

This command allows you to specify the background color for the current instruction or data item.

Only GUI version supports different background colors. Specifying a non-defined custom color will reset the instruction color.

Hide/unhide a border

Action    name: ToggleBorder
 

This command allows you to hide a thin border which is like the one generated automatically by IDA between instructions and data. If the border was already hidden, then it is displayed again.

Add struct type...
Declare struct var
change default value

You can specify function boundaries using the . If you don't specify any, IDA will try to find the boundaries automatically:

Here you can change function bounds, its name and . In order to change only the function end address, you can use command.

You may specify the number of bytes in each part of the stack frame. The size of the return address is calculated by IDA (possibly depending on the far function ).

"BP based frame" allows IDA to automatically convert [BP+xxx] operands to .

The function does not return to caller (for example, calls a process exit function or has an infinite loop). If no-return analysis is enabled in , IDA will not analyze bytes following the calls to this function.

On processors which distinguish near and far functions (e.g. PC x86), mark the function as 'far'. This may affect the size of the special field reserved for the return address, as well as analysis of calls to this function.

Mark the function as part of compiler runtime library code. This flag is usually set when applying

Inform IDA that the function uses a frame pointer (BP/EBP/RBP on PC) to access . The operands of the form [BP+xxx] will be automatically converted to .

There may be two special fields in this window: " r" and " s". They represent the size of the function return address and of the saved registers in bytes. You cannot modify them directly. To change them, use command.

In order to create or delete a stack variable, use data definitions commands (, , , , ). Also you may define or comments.

The defined stack variables may be used in the program by converting operands to .

See also .

You cannot use this command if the current instruction does not belong to any .

See also .

You cannot use this command if the current instruction does not belong to any .

- for really complicated cases can be used. IDA also understands the "__userpurge" calling convention. It is the same thing as __usercall, the only difference is that the callee cleans the stack.

__enum()

__offset()

__strlit() __stroff()

__custom()

__tabform()

__shifted declaration

See also command.

See also command.

The `lineitems` and `alignment` attributes have the meaning described for the command.

See also submenu.

This command gives name/renames/deletes for the specified address. This is a more powerful variant of command.

If the specified address is referenced, you cannot delete its name. Even if you try it, IDA will generate a name.

This command is available only from the .

For an explanation about the dialog box entries, please see the command.

See also submenu. . .

See also submenu.

IDA will ask you to choose a structure type. You must have some structure types in order to use this command.

If the supports it, IDA will display the structure in terse form (using just one line). To uncollapse a terse structure variable use the command.

You can create a file and use an external tool to apply the patches or you can apply the directly to the file using IDA.

submenu.

You can modify the executable file and eventually file.

If you patch bytes, then you may enter multiple bytes. Follow this to learn about format of the input string.

You can create a file too.

See also .

See also .

See also .

submenu.

If you select a range using the , IDA will propose the start address and the end address of the selection as defaults for the segment bounds.

Click to learn about addressing model used in IDA.

If "sparse storage" is set, IDA will use special sparse storage method for the segment. This method is recommended for huge segments. Later, it is possible to change the storage method of any region using IDC function.

Normally a SegmentBase is a 16bit quantity. To create a segment with base >= 0x10000, you need to use . However, if you try to create a segment with a segment base >= 0x10000, IDA will automatically choose appropriately a free selector and setup for the new segment.

All SegmentBases are looked up in the table.

Click to see an example of segment creation (simple case - IBM PC)

Click to see an example of segment creation (simple case - Z80)

Click to see another example of segment creation (automatically chosen selector)

Click to see another example of segment creation (user-defined selector)

See also

If the example we saw how IDA allocates a selector automatically. You could make it yourself:

1. Create a selector. For this, open the and press Ins. Enter a selector number and its value.

You can also edit (see below) an adjacent segment to it to those addresses.

To disassemble the addresses occupied by the segment, you need to create a new segment again (i.e. you cannot disassemble bytes without a segment). You can also another adjacent segment to these addresses.

MOVE ADJACENT SEGMENTS: means that the previous and next segments will be shrunk or expanded to fill gaps between segments. Click for more information.

one segment. Choose one with bad segment base value. Do not disable addresses occupied by the segment being deleted.

change bounds of another segment. Note that the segment command changes the boundaries of the overlapping segment automatically.

IMPORTANT NOTE1: If you use the segment translations, make sure that all segments have unique segment bases. If two segments are placed in the linear address space so that they must have the same segment base, you may assign different with equal values to them.

IMPORTANT NOTE2: IDA supports only one translation list per segment. This translation is applied by default to all instruction in the segment. If the segment uses other mappings, then these individual mappings can be specified for each instruction separately by using the commands.

IMPORTANT NOTE3: Since only code references are affected by the segment translations, try to create the RAM segment at its usual place (i.e. its linear address in IDA corresponds to its address in the processor memory). This will make all data references to it to be correct without any segment translation. For the data references to other segments you'll need to use the command for each such reference.

To specify a value other than the default value of a segment register, you can use command.

See also

This command creates or updates a segment register .

See for more info.

When IDA encounters an instruction which changes a segment register, it creates a segment register change point. So, mostly change points are maintained by IDA itself. IDA assumes that the segment registers do not change their values between change points. If you find out that IDA failed to locate a segment register change, or if you want to change a register value, you can create a change point using command. You can change the value of a segment register using command too.

IDA generates the appropriate 'assume' instructions for the change points if it was not disabled by .

See also submenu.

.

Use it if IDA cannot represent the current instruction as desired. If the instruction itself is ok and only one operand is misrepresented, then use command.

Note that you can hide all borders at once in the .

anchor
stack variables
FLIRT signatures
stack variables
Convert to stack variable
Convert to stack variable
create array
Edit
name
Rename
Rename current address
Edit
Edit
How to Enter a Number
How to Enter a Number
How to jump to a segment
Edit
anchor
set_storage_type
How to enter segment value
How to enter segment value
How to Enter a Number
Edit
How to Enter an Address
Enter operand manually
Create function...
Edit function...
Append function tail...
Remove function tail...
Delete function...
Set function end
Define stack variables...
Change stack pointer...
Rename register...
Set function/item type...
flags
FunctionEnd
flag
stack frame
stack variables
local variables
edit function
function
function
this syntax
enumeration member (symbolic constant)
offset expression
string
structure offset
custom data type and format
tabular form
shifted pointer
Set type
Set type
data
strlit
array
undefine
Rename
regular
repeatable
Struct var...
Force zero field offset
Select union member...
Create struct from selection
Copy field info to pointers...
defined
Produce EXE file
Produce DIF file
generate a new
difference
Produce DIF file
difference
patches
Patch byte or word
Assemble...
Apply patches to input file...
link
Create a new segment...
Delete a segment...
Change segment attributes...
Move a segment...
Rebase program...
Change segment translation...
Set default segment register value...
Change segment register value...
How to choose a segment
here
here
here
here
here
How to change segment translation
previous
expand
expand
How to change segment name
How to change segment class
How to change segment addressing mode (16/32)
How to change segment alignment
How to change segment combination
delete
create
addressing space concepts
change segment register value
change point
Change Segment Register
Set default segment register value
the corresponding command
make offset
make offset
Create alignment directive...
Manual instruction...
Color instruction...
Hide/show border

Center current line in window

 Action    name: CenterInWindow
 

This command centers the cursor.

jump to segment register change point
return
jump to segment register change point

Jump

In this menu, you can select a command to jump to the specified location in the file. Jumps are very fast and your previous position is saved. This submenu contains the following items:

See also

Jump immediate

 Action    name: JumpEnter
 

By pressing <Enter> you navigate in the program in the same way as in a hypertext (the way the web browsers and help screens use).

This is the easiest way to explore the program: just position the cursor at the desired name and press "@<JumpEnter>".

See also

Jump back

 Action    name: Return
 

See also

Undo the last 'Return' Command

 Action    name: UndoReturn
 

See also

Empty navigation stack

 Action    name: EmptyStack
 

See also

Jump stack

Jump to the specified address

Action    name: JumpAsk
 

This command jumps to the specified address in the program. IDA will ask you for the target address. You can enter a name or an address as a hexadecimal number with or without a segment. If you enter a valid address then:

In the structure and enum views, the cursor will be moved to the corresponding offset in the current type.

See also

Jump to the specified file offset

Action    name: JumpFileOffset
 

IDA will ask you for a target file offset. This command jumps to the address corresponding to this specified file offset. If this file offset corresponds to a valid address then:

Jump to the named location

Action    name: JumpName
 

This command allows you to jump to a name definition by selecting it from the list of the names.

Jump to the specified segment

Action    name: JumpSegment
 

This command jumps to the start of the selected segment. IDA will ask you to select the target segment. After:

See also:

Jump to the specified segment register change point

Action    name: JumpSegmentRegister
 

Jump to a problematic location

Action    name: JumpQ
 

Mark Position

 Action    name: MarkPosition
 

First select a slot for the mark, then enter a description for the location.

Jump to previously marked position

Action    name: JumpPosition
 

This command jumps to the selected position. IDA will ask you to select a target position. After:

  • the cursor is positioned to the specified address.

Jump to cross reference

This command shows you a list of cross-references to the current location: you can jump to the selected one by pressing Enter.

See also

Cross reference attributes

The cross reference dialog displays a list of references to the various items. Each line has the following attributes:

Direction Up or Down. Meaningful for program address; denotes where the reference comes from, from the lower addresses than the reference target (down) or from higher addresses (up).

Type

        The following types exist:

          o - offset, the address of the item is taken
          r - read access
          w - write access
          t - textual referenced (used for manually specified operands)
          i - informational (e.g. a derived class refers to its base class)
          J - far (intersegment) jump
          j - near (intrasegment) jump
          P - far (intersegment) call
          p - near (intrasegment) call
          ^ - ordinary flow
          s - xref from a structure
          m - xref from a structure member
          k - xref from a stack variable

Address

        For 'xrefs to' dialogs: where the reference comes from (source)
        For 'xrefs from' dialogs: where the reference goes to (destination)

Text

        Additional info about the cross reference

Jump to cross reference from current location

Action    name: JumpXrefFrom
 

This command shows you a list of cross-references from the current location: you can jump to the selected one by pressing Enter.

See also

Jump to cross references to operand

 Action    name: JumpOpXref
 

This command shows you a list of cross-references to the current operand: you can jump to the selected one by pressing Enter.

See also

Jump to function

 Action    name: JumpFunction
 

This command shows you a list of functions: you can jump to the selected one by pressing Enter.

See also

Jump to next function

Action    name: JumpNextFunc
 

This command searches the start of the next function and jumps to the found address.

Jump to previous function

 Action    name: JumpPrevFunc
 

This command searches the start of the previous function and jumps to the found address.

Jump to Entry Point

 Action    name: JumpEntryPoint

This command shows you a list of entry points: you can jump to the selected one by pressing Enter.

The list of entry points is created at the database creation time. It is not modified after that (for example, renaming an exported function does not change the list of entry points).

REGULAR EXPRESSION SYNTAX SUMMARY

The full syntax and semantics of the regular expressions that are supported by PCRE2 are described in the pcre2pattern documentation. This document contains a quick-reference summary of the syntax.

QUOTING

ESCAPED CHARACTERS

This table applies to ASCII and Unicode environments.

Note that \0dd is always an octal code. The treatment of backslash followed by a non-zero digit is complicated; for details see the section "Non-printing characters" in the pcre2pattern documentation, where details of escape processing in EBCDIC environments are also given.

When \x is not followed by {, from zero to two hexadecimal digits are read, but if PCRE2_ALT_BSUX is set, \x must be followed by two hexadecimal digits to be recognized as a hexadecimal escape; otherwise it matches a literal "x". Likewise, if \u (in ALT_BSUX mode) is not followed by four hexadecimal digits, it matches a literal "u".

CHARACTER TYPES

\C is dangerous because it may leave the current matching point in the middle of a UTF-8 or UTF-16 character. The application can lock out the use of \C by setting the PCRE2_NEVER_BACKSLASH_C option. It is also possible to build PCRE2 with the use of \C permanently disabled.

By default, \d, \s, and \w match only ASCII characters, even in UTF-8 mode or in the 16-bit and 32-bit libraries. However, if locale-specific matching is happening, \s and \w may also match characters with code points in the range 128-255. If the PCRE2_UCP option is set, the behaviour of these escape sequences is changed to use Unicode properties and they match many more characters.

GENERAL CATEGORY PROPERTIES FOR \p and \P

PCRE2 SPECIAL CATEGORY PROPERTIES FOR \p and \P

Perl and POSIX space are now the same. Perl added VT to its space character set at release 5.18.

SCRIPT NAMES FOR \p AND \P

Ahom, Anatolian_Hieroglyphs, Arabic, Armenian, Avestan, Balinese, Bamum, Bassa_Vah, Batak, Bengali, Bopomofo, Brahmi, Braille, Buginese, Buhid, Canadian_Aboriginal, Carian, Caucasian_Albanian, Chakma, Cham, Cherokee, Common, Coptic, Cuneiform, Cypriot, Cyrillic, Deseret, Devanagari, Duployan, Egyptian_Hieroglyphs, Elbasan, Ethiopic, Georgian, Glagolitic, Gothic, Grantha, Greek, Gujarati, Gurmukhi, Han, Hangul, Hanunoo, Hatran, Hebrew, Hiragana, Imperial_Aramaic, Inherited, Inscriptional_Pahlavi, Inscriptional_Parthian, Javanese, Kaithi, Kannada, Katakana, Kayah_Li, Kharoshthi, Khmer, Khojki, Khudawadi, Lao, Latin, Lepcha, Limbu, Linear_A, Linear_B, Lisu, Lycian, Lydian, Mahajani, Malayalam, Mandaic, Manichaean, Meetei_Mayek, Mende_Kikakui, Meroitic_Cursive, Meroitic_Hieroglyphs, Miao, Modi, Mongolian, Mro, Multani, Myanmar, Nabataean, New_Tai_Lue, Nko, Ogham, Ol_Chiki, Old_Hungarian, Old_Italic, Old_North_Arabian, Old_Permic, Old_Persian, Old_South_Arabian, Old_Turkic, Oriya, Osmanya, Pahawh_Hmong, Palmyrene, Pau_Cin_Hau, Phags_Pa, Phoenician, Psalter_Pahlavi, Rejang, Runic, Samaritan, Saurashtra, Sharada, Shavian, Siddham, SignWriting, Sinhala, Sora_Sompeng, Sundanese, Syloti_Nagri, Syriac, Tagalog, Tagbanwa, Tai_Le, Tai_Tham, Tai_Viet, Takri, Tamil, Telugu, Thaana, Thai, Tibetan, Tifinagh, Tirhuta, Ugaritic, Vai, Warang_Citi, Yi.

CHARACTER CLASSES

In PCRE2, POSIX character set names recognize only ASCII characters by default, but some of them use Unicode properties if PCRE2_UCP is set. You can use \Q...\E inside a character class.

QUANTIFIERS

ANCHORS AND SIMPLE ASSERTIONS

MATCH POINT RESET

\K is honoured in positive assertions, but ignored in negative ones.

ALTERNATION

CAPTURING

ATOMIC GROUPS

COMMENT

OPTION SETTING

The following are recognized only at the very start of a pattern or after one of the newline or \R options with similar syntax. More than one of them may appear. (*LIMIT_MATCH=d) set the match limit to d (decimal number)

Note that LIMIT_MATCH and LIMIT_RECURSION can only reduce the value of the limits set by the caller of pcre2_match(), not increase them. The application can lock out the use of (*UTF) and (*UCP) by setting the PCRE2_NEVER_UTF or PCRE2_NEVER_UCP options, respectively, at compile time.

NEWLINE CONVENTION

These are recognized only at the very start of the pattern or after option settings with a similar syntax.

WHAT \R MATCHES

These are recognized only at the very start of the pattern or after option setting with a similar syntax.

LOOKAHEAD AND LOOKBEHIND ASSERTIONS

Each top-level branch of a look behind must be of a fixed length.

BACKREFERENCES

SUBROUTINE REFERENCES (POSSIBLY RECURSIVE)

CONDITIONAL PATTERNS

BACKTRACKING CONTROL

The following act immediately they are reached:

The following act only when a subsequent match failure causes a backtrack to reach them. They all force a match failure, but they differ in what happens afterwards. Those that advance the start-of-match point do so only if the pattern is not anchored. (*COMMIT) overall failure, no advance of starting point

CALLOUTS

The allowed string delimiters are ` ' " ^ % # $ (which are the same for the start and the end), and the starting delimiter { matched with the ending delimiter }. To encode the ending delimiter within the string, double it.

View

Here are commands to open various windows, display information etc.

Search

You can search for:

See also

Search for next suspicious operand

Data arrays are considered to be suspicious if the first element of the data array is within the lower and upper suspicious limits. Values of other elements are not examined.

NOTE: We strongly recommend that before producing an ASM file you go through all 'suspicious' marks and get rid of them. After this you have a certain level of confidence that the file has been disassembled correctly.

Search for next code

Search for next data

Search for next unexplored byte

Search for next explored byte

Search for next instruction/data with the specified operand

This command searches for the first instruction or data byte that contains the specified immediate value. The command is relatively slow (but much faster than the text search), because it disassembles each instruction to find the operand values.

If the immediate value in an instruction has been logically or bitwise negated, then this command will check against the modified value. Example:

will be found if the user searches for the immediate value 2 but not when he searches for 0xFE.

If the checkbox "any untyped value" is checked, then the "value" field is ignored. IDA will look for all immediate values without type in this case.

Repeat search for instruction/data with the specified operand

Search for substring in the disassembly

Note that this command searches the same as what you see on your screen (and not in binary image).

Repeat search for substring in the disassembly

Search for substring in the file

This command searches for the specified substring in the file being disassembled. This command can be used for fast lookups of text strings in the executable file or even to find references to a data. You can interrupt it pressing Ctrl-Break.

The substring is specified like this:

i.e. in the double-quotes. Also you can specify individual byte values as numbers:

For example, if you want to find a reference to the following string:

you could search for number 106A in the file.

See also

Repeat search for substring in the file

Search for bytes not belonging to any function

Set Direction for Searches

The current direction for searches is displayed in the right upper corner of the screen. Using this command, you can toggle the display.

Find all suspicious operands

This command searches for all suspicious operands and presents a list of them. You may use this list to examine the operands and modify them as needed.

See also

Search for next string with error

This commands searches for the 'error' operands. Usually, these operands are displayed with a red color.

Below is the list of probable causes of error operands:

Find all errors

This command searches for all strings containing any error and presents a list of them. You may use this list to examine errors and correct them as needed.

See also

Problems List

The following problems may occur:

Problem: Cannot find offset base

What to do: Mark the operand again as an offset. Use one of the following commands:

Problem: Cannot find name

Description: Two reasons can cause this problem: 1.Reference to an illegal address is made in the program being disassembled; 2.IDA couldn't find a name for the address but it must exist. What to do:

  1. If this problem is caused by a reference to an illegal address

  1. Otherwise, the database is corrupt.

Problem: Cannot find alternative string for an operand

Problem: Cannot find comment

Problem: Cannot find references

Problem: Indirect execution flow

Problem: Cannot disassemble

Possible reason(s):

  1. The specified bytes do not form an instruction.

Problem: Already data or code

Problem: Execution flows beyond limits

Description: IDA encountered a jump or call instruction to an illegal address. Namely:

  • jump/call beyond program segments

  • near jump/call beyond the current segment What to do:

  1. or Change the current segment bounds using one of the following:

Problem: Too many lines

What to do:

Problem: Failed to trace the value of the stack pointer

What to do:

Problem: Attention! Probably erroneous situation

Problem: Decision to convert to instruction/data is made by IDA

Problem: The decision made by IDA was wrong and rolled back

FLIRT collision: the function with the given name already exists

FLIRT match indecision: reference to function expected

Message Window

IDA opens a special non-closable window at the start. This window is called "message window". In this window you see various IDA messages.

If the message window is hidden behind other windows, you will not see the IDA messages.

You can duplicate all messages appearing in this window to a file. For this, you have to define an environment variable:

Graphs

Here are commands to draw various graphs:

IDA uses an external program to display graphs. The program name is wingraph32.exe and it is located in the current directory.

The user can zoom the graph and move it around the window.

Display function flow-chart

This command displays the flow chart of the current function.

The colored edges of the flow chart represent the outcome of conditional jump instructions. Green means that the condition is satisfied, red means not satisfied.

Display function call graph

This command displays the graph of all function calls in the program.

The functions are represented as nodes. The calls are represented as edges between nodes. Instructions outside functions are ignored.

Display chart of xrefs to addresses

This command displays the graph of code and data xrefs to current address/range of selected addresses in the program.

The addresses are represented as nodes. The xrefs are represented as edges between nodes.

Display chart of xrefs from addresses

This command displays the graph of code xrefs from the current address/range of selected addresses in the program.

In this direction, data xrefs aren't analyzed to avoid overloaded graphs.

The addresses are represented as nodes. The xrefs are represented as edges between nodes.

Display used-defined chart of xrefs

This command displays a user-defined graph of xrefs from/to the current address/range of selected addresses in the program.

The direction of the xrefs to analyze can be chosen. If the Recursive flag is checked, all found xrefs are themselves analyzed to find new xrefs. You can choose to search for xrefs to new referenced addresses only in the current direction. Only External, data xrefs, xrefs from library functions and to library functions can possibly be ignored.

A recursion depth can be specified. If 'Print recursion dots' is checked, and a function has others xrefs outside of the range defined by the 'recursion depth' setting, small nodes containing dots are printed.

The 'Print comments' flag causes the generated function node to also contain the function comment.

The addresses are represented as nodes. The xrefs are represented as edges between nodes. The used colors are the same as in IDA.

Open subviews

Here are commands to open various windows, display information etc.

Disassembly window

The "WindowOpen" command opens a new window with the disassembly. IDA automatically opens one disassembly window at the start.

A double click of the mouse is equivalent to the <Enter> key.

Exports window

This command opens the exports window.

Imports window

This command opens the imports window.

Functions window

Listed for each function are:

The last column of this window has the following format:

If a function has its color set, its line is colored using the specified color. Otherwise library and lumina functions are colored with the corresponding color. Otherwise the line is not colored.

A bold font is used for functions that have definite (user-specified) prototype. Also some plugins too may set this flag. Such prototypes are taken as is by the decompiler, while other prototypes are considered only as a starting point during decompilation.

It is possible to automatically synchronize the function list with the active disassembler, pseudocode, or hex view. For that right click on the function list and select "Turn on synchronization".

Names window

The GUI version displays a small icon for each name:

Signatures window

This command opens the signatures window.

For each signature, the following is displayed:

You can modify the planned signatures list here: add/delete library modules to be used during the disassembling.

You cannot delete an applied signature from the list.

To add a signature to the list for the application press <Ins>. You will see a list of signatures that can be applied to the program being disassembled.

Text version: Not all signature files will be displayed (for example, 32 bit signatures will not be shown for a 16 bit program). If you want to see the full list of signatures, select the first line of the list saying SWITCH TO FULL LIST OF SIGNATURES.

Signature files reside in the subdirectories of the SIG directory. Each processor has its own subdirectory. The name of the subdirectory is equal to the name of the processor module file (z80 for z80.w32, for example). Note: IBM PC signatures are located in the SIG directory itself. Note: the IDASGN environment variable can be used to specify the location of the signatures directory.

Segments window

Segment registers window

Depending on the current processor type, you will see DS,ES,SS with or without FS,GS.

Selectors window

Cross references window

This command opens the cross-references window. This window contains all references to the current location.

You can add and delete cross references here too by pressing Ins or Del. Right clicking on the mouse will work too.

Add a cross reference: the from and to address, as well as the xref type should be specified.

Del a cross reference: if the 'undefine if no more xrefs' is check, then the instruction at the target address will be undefined upon the deletion of the last xref. IDA undefines instructions only if they do not start a function.

Local types window

As of IDA 9.0, the legacy Structure and Enums windows have been removed and their functionality consolidated by the Local Types window. This view serves as a centralized hub for all type-related actions. You can define new types here (enumerations, structures, and unions), edit existing ones, and import types from loaded type libraries.

This command opens the local types window. The user can manipulate local types here:

  • the existing types can be modified (the default hotkey is Ctrl-E, context menu Edit type...)

  • the existing types can be deleted (the default hotkey is Del, context menu Delete type...)

  • new types can be added (the default hotkey is Ins, context menu Add type...)

Please note that Ins can be used to add many types at once. For that the user just needs to enter multiple declarations, one after another in the dialog box.

However, Ctrl-E permits for editing of one type at a time. This may cause problems with complex structure types with nested types. Nested types will not be saved by Ctrl-E.

If the edited type corresponds to an idb type (struct or enum), then the corresponding type will be automatically synchronized.

Each type in the local type library has an ordinal number and may have a name.

Be careful when deleting existing types because if there are references to them, they will be invalidated.

A local type can be mapped to another type. Such an operation deletes the existing type and redirects all its references to the destination type. Circular dependencies are forbidden. In the case of a user mistake, a mapped type can be deleted and recreated with the correct information.

See also

Managing Structures**

Structs-related commands available in the local types window:

Define a new structure

If the entered structure name denotes a standard structure type from a loaded type library, then its definition will be automatically used. In this case, the value of the 'create union' checkbox will be ignored.

You can add new members to the structure using the following commands:

"Create before current structure" means that the new structure will be placed immediately before the current structure type. Otherwise, the new structure is placed after the current structure.

"Don't include in the list" means that the structure will not be included in the list of the structures which appears when the user applies the structure definition, for example, when he creates a variable of this structure type. We recommend to mark this checkbox when you have defined all variables of this structure type and want to reduce the number of choices in the list.

Duplicate a structure type

This command duplicate the current structure type. The new structure type will have the same members as the current one but its name will be autogenerated (something like struc_333)

By default the new structure type will be placed after the current structure type.

Delete a structure

This command deletes the current structure. Beware, when you delete a structure, all references to it will be destroyed as well. Even if you recreate it later, you'll have to specify again all references to it.

You may use this command to delete unions also.

Expand a structure

This command expands the current structure by inserting undefined bytes at the cursor location. The cursor must not be at the end of the structure. To define a member at the end of the structure, just use normal data definition commands.

Shrink a structure

This command shrinks the current structure by deleting undefined bytes at the cursor location. The cursor must be at an undefined byte. IDA will ask the user the number of bytes to remove.

Edit a structure

This command allows the user to change the structure alignment

Structure alignment is used to calculate the number of padding bytes at the end of the structure. For example, if alignment is 4 and the last field is a byte at offset 11h, IDA will add 3 bytes of padding so that the struct size is 14h (multiple of 4).

Managing Enums

Enums-related commands available in the local types window:

Add/Edit an enum

These commands allow you to define and to edit an enum type. You need to specify:

Each enum has its ID and a serial number. The ID is a number used to refer to the enum, while a serial number is used to order enums during output. Changing the serial number moves the enum to another place.

The serial number of an enum is displayed at the lower left corner of the window.

You can specify any number as a serial number, IDA will move the enum to the specified place.

You also need to specify representation of enum constants. You may choose from various number bases (hex,dec,oct,bin) and character constants.

You may specify the element width or leave it zero. Zero means the element width is not specified. The allowed widths are the powers of 2 in the range of 1..64.

Delete an enum type

This command deletes the current enum. Beware, when you delete an enum all references to it will be destroyed. Even if you recreate it later, you'll have to specify again all references to it.

Define an enum member

This command allows you to define an enum member. An enum member is a symbolic constant. You have to specify its name and value. You cannot define more than 256 constants with the same value in an enum.

Edit an enum member

This command allows you to rename an enum member. An enum member is a symbolic constant. Its name must be unique in the program.

To rename an enum type name, position the cursor over the name of the enum.

Delete an enum member

Please remember that deleting a member also deletes all the information about the member, including comments, member name etc.

Problems window

You can jump to a problem by pressing Enter. The selected problem will be deleted from the list.

Type libraries window

This command opens the type libraries window. Here the user can load and unload standard type libraries.

The standard type libraries contain type definitions from the standard C header supplied with compilers. Usually, IDA tries to determine the target compiler and its type libraries automatically but if it fails, this window allows you to load the appropriate type library.

Inspecting a type library

Provide the ability to inspect the types present in a type library.

Local Types bookmarks

Strings window

This command opens the string window.

The string window contains all strings in the program. However, if a range of addresses was selected before opening the window, only the selected range will be examined for strings.

You can setup the list parameters by right-clicking (or pressing Ctrl-U in the text version) on the list.

The list always contains strings defined in the program regardless of the settings in this dialog box, but the user can ask IDA to display strings not yet explicitly defined as strings.

The following parameters are available:

Minimal string length

Function calls window

This command opens the function calls window.

All functions who call the current function are displayed at the top of the window.

All functions called from the current function are displayed at the bottom of the window.

The list is automatically refreshed when the cursor is moved to another function.

Notepad

Opens a notepad window for the general notes about the current database. The entered notes will be saved in the current database.

Alt-T hotkey can be used to search for a text and Ctrl-T to repeat the last search.

The notepad is available only in the GUI version.

Show undo history

This command opens a window with the undo history. It is available from the Views, Open subviews submenu.

Double clicking on a line reverts the database to the state before the corresponding action.

It is possible to truncate the undo history by using the corresponding context menu command. The undo information for the selected action will be removed together with the information about all preceding actions.

The redoable user actions are displayed in italics. The current position in the undo buffers is displayed in bold, it usually denotes the first redoable user action.

See also

Edit|Other
How to Enter an Identifier
Unhide
name list

menu for fast navigating.

concept.

submenus

Your current address is saved in the .

The command (usually Esc) will return you back.

If the cursor is at a stack variable, a window with is opened and the definition of the stack variable is displayed.

command.

This command brings you back to the previous position in the history. It takes positions from .

command

command.

This command cancels the last command.

command.

This command clears the .

command.

Each IDA Window has its own jump stack. This stack keeps the cursor locations. Many IDA commands use the jump stack, i.e. they save the old cursor position to the stack. For example, when you are at the address 3000:0100 and press the Ctrl-C key (find instruction), the 3000:0100 is saved into the jump stack and the search is started. Afterwards, you can return to the old position using command.

You can clear the jump stack using the menu command.

the current address is saved in the .

the cursor is positioned to the specified address. The command (usually Esc) will return you back.

.

the current address is saved in the .

the cursor is positioned to the corresponding address. The command (usually Esc) will return you back.

IDA will display the list of the names (sorted by addresses) and you can choose a name. names (generated by IDA) are not listed. Hidden names are not listed either. You can control which names are listed in the dialog box.

See also .

the current address is saved in the .

the cursor is positioned to the specified address. The command (usually Esc) will return you back.

This command jumps to the selected . IDA will ask you to select a target change point. And after:

the current address is saved in the .

the cursor is positioned to the specified address. The command (usually Esc) will return you back.

This command allows you to jump to a problematic location. IDA will display the and will allow you to select a problem.

The command (usually Esc) will return you back.

You can mark certain locations of the file to be able to to them quickly. Text description of the location may help to find a desired location easily.

the current address is saved in the .

The command (usually Esc) will return you back.

You can mark the position using command.

Click to see the description of the cross reference dialog box.

Click to see the description of the cross reference dialog box.

Click to see the description of the cross reference dialog box.

See also submenus.

In this menu, you can select a command to search for something in the disassembly. Searches are relatively slow and your previous position is saved in the .

(instructions that need your attention)

in both - (up and down).

menu for fast navigating.

submenus

Suspicious operands are the operands that need your attention because they contain an immediate value that could be a number or an offset. IDA does not know about it, so it marks these instructions as 'suspicious'. You can change the suspiciousness of the operands using and commands.

You can disable the display of the 'suspicious' marks in the .

This command searches for the first in the .

This command searches for the first item in the .

This command searches for the first byte in the .

This command searches for the first defined byte ( or ) in the .

This command repeats command.

This command searches for the specified substring in the text representation of the disassembly. This command is a slow command, because it disassembles each instruction to get the text representation. IDA will show its progress on the . You can interrupt this command pressing Ctrl-Break.

You may search for too.

If a range is selected using , IDA will search for the specified substring in the range.

For binary search, look at

This command repeats command.

If a range is selected using , IDA will search for the specified substring in the range.

Follow this to learn more about the format of the input string.

command.

This command repeats command.

This command searches for the first byte not belonging to any function in the .

See also submenu.

NOOFFSET

NONAME

NOFORCED

NOCMT

NOREF

INDIRJMP

NODISASM

ALREADY

BOUNDS

OVERFLOW

BADSTACK

LOOKHERE

DECISION

ROLLBACK

COLISION

SIGFNREF \

See also submenu.

try to enter the operand

or make the illegal address legal by a new segment.

What to do: Enter the operand manually again. Use one of the following commands:

What to do: Database is corrupt, the best thing to do is to the database.

The current type is incorrect. What to do: If you are sure that the specified bytes contain an instruction, you can try to change type and mark these bytes as an instruction using the following command:

Description: IDA cannot convert this byte(s) to an or because it would overlap another instruction. What to do: Make the following overlapping instruction or data 'unexplored' using command.

Enter the operand

or Create a new making the illegal address legal

If the current item is an or , try to divide it. or

Delete or

Disable display or 4. Increase the limit in IDA.CFG, the parameter name is MAX_ITEM_LINES.

Examine the value of at various locations of the function and try to find out why the stack tracing has failed. Usually, it fails because some called function changed the stack pointer (by purging the input parameters, for example)

If you have found the offending function, its attributes (namely, number of bytes purged upon return).

Another way is to specify manually how the stack pointer is modified. See command

The user can change the name of this program using the GRAPH_VISUALIZER parameter in the file.

See also submenu.

Some windows allow you to manipulate the window contents by using the viewer commands.

See also submenu.

If the current location is an instruction belonging to a function, then the is available. You can toggle between the text and graph view using the Space key. You can also switch to proximity view by zooming out to the callgraph using the '-' key.

Use the disassembly commands to improve the listing.

Use Shift-<arrows> or Alt-L to drop . If you have a mouse, you can drop the anchor with it too.

To the left of disassembly, there is an (GUI version). Also the GUI version the current identifier.

You can use commands in this window.

You can use commands in this window.

A list of all functions in the program is displayed. You can , , functions using viewer commands.

This command opens the window.

You can use commands in this window.

This command opens the segments window. The format of this window is explained .

You can use commands in this window.

In order to change the selector values, use window.

This command opens the segment registers window. The window will contain segment register list.

You can use commands in this window.

See also submenu.

This command opens the selector window. Here you can change the "selector to base" mapping. The selector table is used to look up the selector values when the addresses that are visible in the disassembly listing.

You can use commands in this window:

You can use commands in this window.

Each database has a local type library embedded into it. This type library (til) is used to store types that are local to the current database. They are usually created by a header file.

Some types in this list are created automatically by IDA. They are copies of the types defined in the or views. Such types are displayed using in gray, as if they are disabled.

Types displayed in black are considered as C level types. Read .

Each structure must have a unique name. A field name must be unique in the structure. In order to create or delete a field, use data definitions commands (, , , , ). You may also define or comments.

In order to modify member types, use commands from the submenu. For example, to convert a structure member to an offset, use one of the following commands:

This command defines a new structure or a new union. The new structure is created with zero length. You will have to add structure members using manipulation commands.

This command is available when you open a .

Command
Hotkey

You may also insert/delete undefined bytes into the middle of the structure by using and commands.

See also .

This command is available when you open a .

This command is available when you open a .

This command is available when you open a .

The alignment must be a power of 2. This command is available in the .

See also .

Please note that you can create definitions here by checking the "bitfield" checkbox.

These command is available when you open the types .

See also .

This command is available when you open the types .

If the current enum is a bitfield, you need to specify the bitmask. To learn about bitmasks, read about .

This command opens the problems window. The problem window contains the of all problems encountered by IDA during disassembling the program.

Furthermore, don't forget to specify the compiler and memory model in the dialog box.

See:

Display only defined strings If checked, IDA will display only strings explicitly marked as string items (using the command). In this case, the other checkboxes are ignored. Ignore instructions/data definitions

Strict ASCII (7-bit) strings If checked, only strings containing exclusively 7-bit characters (8th bit must be zero) will be added to the list. Please note that the user can specify which characters are accepted in the strings by modifying the StrlitChars parameter in the file. This setting is ignored if 'only defined strings' is on. Allowed string types

Search
Menu Bar
How to Enter an Address
How to use the lister
Other segment related commands
Problems List
Jump immediate
Jump back
Undo last jump back
Empty navigation stack
Jump to address
Jump to named location
Jump to segment start
Jump to segment register change point
Jump to problematic location
Mark location
Jump to marked position
Jump to cross reference
Jump to cross reference to operand
Jump to function
Jump to entry point
Jump to file offset
Jumps Stack
jump stack
Jump back
Empty Stack
Jumps Stack
Undo "jump back"
Empty Stack
Jump back
Empty navigation stack
jump stack
Jump back
Jump back
Empty stack
jump stack
Jump back
jump stack
Jump back
jump stack
Jump back
jump stack
Jump back
Jump back
jump
jump stack
Jump back
Mark Position
here
Jump to Cross Reference From
Jump to Cross References to Operand
here
Jump to Cross References
Jump to Cross References to Operand
here
Jump to Cross References
Jump to Cross Reference From
Jump to next function
Jump to previous function
stack variables
How to choose a segment
Segment Register Change Point
  \x         where x is non-alphanumeric is a literal x
  \Q...\E    treat enclosed characters as literal
  \a         alarm, that is, the BEL character (hex 07)
  \cx        "control-x", where x is any ASCII printing character
  \e         escape (hex 1B)
  \f         form feed (hex 0C)
  \n         newline (hex 0A)
  \r         carriage return (hex 0D)
  \t         tab (hex 09)
  \0dd       character with octal code 0dd
  \ddd       character with octal code ddd, or backreference
  \o{ddd..}  character with octal code ddd..
  \U         "U" if PCRE2_ALT_BSUX is set (otherwise is an error)
  \uhhhh     character with hex code hhhh (if PCRE2_ALT_BSUX is set)
  \xhh       character with hex code hh
  \x{hhh..}  character with hex code hhh..
  .          any character except newline;
               in dotall mode, any character whatsoever
  \C         one code unit, even in UTF mode (best avoided)
  \d         a decimal digit
  \D         a character that is not a decimal digit
  \h         a horizontal white space character
  \H         a character that is not a horizontal white space character
  \N         a character that is not a newline
  \p{xx}     a character with the xx property
  \P{xx}     a character without the xx property
  \R         a newline sequence
  \s         a white space character
  \S         a character that is not a white space character
  \v         a vertical white space character
  \V         a character that is not a vertical white space character
  \w         a "word" character
  \W         a "non-word" character
  \X         a Unicode extended grapheme cluster
  C          Other
  Cc         Control
  Cf         Format
  Cn         Unassigned
  Co         Private use
  Cs         Surrogate

  L          Letter
  Ll         Lower case letter
  Lm         Modifier letter
  Lo         Other letter
  Lt         Title case letter
  Lu         Upper case letter
  L&         Ll, Lu, or Lt

  M          Mark
  Mc         Spacing mark
  Me         Enclosing mark
  Mn         Non-spacing mark

  N          Number
  Nd         Decimal number
  Nl         Letter number
  No         Other number

  P          Punctuation
  Pc         Connector punctuation
  Pd         Dash punctuation
  Pe         Close punctuation
  Pf         Final punctuation
  Pi         Initial punctuation
  Po         Other punctuation
  Ps         Open punctuation

  S          Symbol
  Sc         Currency symbol
  Sk         Modifier symbol
  Sm         Mathematical symbol
  So         Other symbol

  Z          Separator
  Zl         Line separator
  Zp         Paragraph separator
  Zs         Space separator
  Xan        Alphanumeric: union of properties L and N
  Xps        POSIX space: property Z or tab, NL, VT, FF, CR
  Xsp        Perl space: property Z or tab, NL, VT, FF, CR
  Xuc        Univerally-named character: one that can be
               represented by a Universal Character Name
  Xwd        Perl word: property Xan or underscore
  [...]       positive character class
  [^...]      negative character class
  [x-y]       range (can be used for hex characters)
  [[:xxx:]]   positive POSIX named set
  [[:^xxx:]]  negative POSIX named set

  alnum       alphanumeric
  alpha       alphabetic
  ascii       0-127
  blank       space or tab
  cntrl       control character
  digit       decimal digit
  graph       printing, excluding space
  lower       lower case letter
  print       printing, including space
  punct       printing, excluding alphanumeric
  space       white space
  upper       upper case letter
  word        same as \w
  xdigit      hexadecimal digit
  ?           0 or 1, greedy
  ?+          0 or 1, possessive
  ??          0 or 1, lazy
  *           0 or more, greedy
  *+          0 or more, possessive
  *?          0 or more, lazy
  +           1 or more, greedy
  ++          1 or more, possessive
  +?          1 or more, lazy
  {n}         exactly n
  {n,m}       at least n, no more than m, greedy
  {n,m}+      at least n, no more than m, possessive
  {n,m}?      at least n, no more than m, lazy
  {n,}        n or more, greedy
  {n,}+       n or more, possessive
  {n,}?       n or more, lazy
  \b          word boundary
  \B          not a word boundary
  ^           start of subject
                also after an internal newline in multiline mode
                (after any newline if PCRE2_ALT_CIRCUMFLEX is set)
  \A          start of subject
  $           end of subject
                also before newline at end of subject
                also before internal newline in multiline mode
  \Z          end of subject
                also before newline at end of subject
  \z          end of subject
  \G          first matching position in subject
  \K          reset start of match
  expr|expr|expr...
  (...)           capturing group
  (?<name>...)    named capturing group (Perl)
  (?'name'...)    named capturing group (Perl)
  (?P<name>...)   named capturing group (Python)
  (?:...)         non-capturing group
  (?|...)         non-capturing group; reset group numbers for
                   capturing groups in each alternative
  (?>...)         atomic, non-capturing group
  (?#....)        comment (not nestable)
  (?i)            caseless
  (?J)            allow duplicate names
  (?m)            multiline
  (?s)            single line (dotall)
  (?U)            default ungreedy (lazy)
  (?x)            extended (ignore white space)
  (?-...)         unset option(s)
  (*LIMIT_RECURSION=d) set the recursion limit to d (decimal number)
  (*NOTEMPTY)     set PCRE2_NOTEMPTY when matching
  (*NOTEMPTY_ATSTART) set PCRE2_NOTEMPTY_ATSTART when matching
  (*NO_AUTO_POSSESS) no auto-possessification (PCRE2_NO_AUTO_POSSESS)
  (*NO_DOTSTAR_ANCHOR) no .* anchoring (PCRE2_NO_DOTSTAR_ANCHOR)
  (*NO_JIT)       disable JIT optimization
  (*NO_START_OPT) no start-match optimization (PCRE2_NO_START_OPTIMIZE)
  (*UTF)          set appropriate UTF mode for the library in use
  (*UCP)          set PCRE2_UCP (use Unicode properties for \d etc)
  (*CR)           carriage return only
  (*LF)           linefeed only
  (*CRLF)         carriage return followed by linefeed
  (*ANYCRLF)      all three of the above
  (*ANY)          any Unicode newline sequence
  (*BSR_ANYCRLF)  CR, LF, or CRLF
  (*BSR_UNICODE)  any Unicode newline sequence
  (?=...)         positive look ahead
  (?!...)         negative look ahead
  (?<=...)        positive look behind
  (?<!...)        negative look behind
  \n              reference by number (can be ambiguous)
  \gn             reference by number
  \g{n}           reference by number
  \g{-n}          relative reference by number
  \k<name>        reference by name (Perl)
  \k'name'        reference by name (Perl)
  \g{name}        reference by name (Perl)
  \k{name}        reference by name (.NET)
  (?P=name)       reference by name (Python)
  (?R)            recurse whole pattern
  (?n)            call subpattern by absolute number
  (?+n)           call subpattern by relative number
  (?-n)           call subpattern by relative number
  (?&name)        call subpattern by name (Perl)
  (?P>name)       call subpattern by name (Python)
  \g<name>        call subpattern by name (Oniguruma)
  \g'name'        call subpattern by name (Oniguruma)
  \g<n>           call subpattern by absolute number (Oniguruma)
  \g'n'           call subpattern by absolute number (Oniguruma)
  \g<+n>          call subpattern by relative number (PCRE2 extension)
  \g'+n'          call subpattern by relative number (PCRE2 extension)
  \g<-n>          call subpattern by relative number (PCRE2 extension)
  \g'-n'          call subpattern by relative number (PCRE2 extension)
  (?(condition)yes-pattern)
  (?(condition)yes-pattern|no-pattern)

  (?(n)               absolute reference condition
  (?(+n)              relative reference condition
  (?(-n)              relative reference condition
  (?(<name>)          named reference condition (Perl)
  (?('name')          named reference condition (Perl)
  (?(name)            named reference condition (PCRE2)
  (?(R)               overall recursion condition
  (?(Rn)              specific group recursion condition
  (?(R&name)          specific recursion condition
  (?(DEFINE)          define subpattern for reference
  (?(VERSION[>]=n.m)  test PCRE2 version
  (?(assert)          assertion condition
  (*ACCEPT)       force successful match
  (*FAIL)         force backtrack; synonym (*F)
  (*MARK:NAME)    set name to be passed back; synonym (*:NAME)
  (*PRUNE)        advance to next starting character
  (*PRUNE:NAME)   equivalent to (*MARK:NAME)(*PRUNE)
  (*SKIP)         advance to current matching position
  (*SKIP:NAME)    advance to position corresponding to an earlier
                  (*MARK:NAME); if not found, the (*SKIP) is ignored
  (*THEN)         local failure, backtrack to next alternation
  (*THEN:NAME)    equivalent to (*MARK:NAME)(*THEN)
  (?C)            callout (assumed number 0)
  (?Cn)           callout with numerical data n
  (?C"text")      callout with string data
Action    name: JumpSuspicious
 
Action    name: JumpCode
 
Action    name: JumpData
 
Action    name: JumpUnknown
 
 Action    name: JumpExplored
 
 Action    name: AskNextImmediate
 
        mov al, -2
 Action    name: JumpImmediate
 
 Action    name: AskNextText
Action    name: JumpText
 
Action    name: AskBinaryText
 
        "This is substring to search"
        6A 10
 35F2:106A      db 'Hello',0
Action    name: JumpBinaryText
 
Action    name: JumpNotFunction
 
 Action    name: SetDirection
 
Action    name: FindAllSuspicious
 
Action    name: JumpError
 
        - reference to an unexisting address
        - illegal offset base
        - unprintable character constant
        - invalid structure or enum reference
        - and so on...
Action    name: FindAllErrors
 
suspicious
suspicious
suspicious
void
Description:
        The current item has an operand marked as an offset,
        but IDA cannot find the offset base in the database.

 Possible reason(s):
        The database is probably corrupted.
        This may occur if the database was corrupted and repaired.
 Description:
        The current item has an operand marked as entered manually,
        but IDA cannot find the manually entered string in the database.

 Possible reason(s):
        The database is corrupt.
Should not happen!
Please inform the author if you encounter this problem.
Description:
        The current item is marked as referenced from other place(s) in the
        program, but IDA cannot find any reference to it.

 Possible reason(s):
        The database is corrupt.
Description:
        Actually, this is not a problem. IDA warns you
        that here it encountered an indirect jump and
        couldn't follow the execution.

 What to do:
        Nothing, this entry is just for your information
Description:
        IDA cannot represent the specified bytes as an instruction.
 Description:
        The current item (instruction or data) occupies more lines
        on the screen than it is allowed by the current configuration.
Description:
        The value of the stack pointer at the end of the function is different
        from its value at the start of the function. IDA checks for the
        difference only if the function is ended by a "return" instruction.
        The most probable cause is that stack tracing has failed.
        This problem is displayed in the disassembly listing with
        the "sp-analysis failed" comment.
Description:
        This is a generic problem message. IDA uses it when no more detailed
        information is available or the problem is processor-specific.
 Description:
        In fact, this is not exactly a problem: IDA collects all the locations
        where it has decided to convert undefined bytes to
        instructions or data even if they don't have
        any references to them. We consider this decision as dangerous
        and therefore we provide you with a way to examine all such places.

 What to do:
        Examine the result of conversion and modify the instructions
        or data if IDA has made a wrong conversion.
 Description:
        This problem occurs when IDA has converted unexplored bytes to
        instruction(s) and later found that the decision was wrong.
        For example:

                mov     ax, bx
                db 0FFh, 0FFh

        0FFh, 0FFh cannot be converted to an instruction, therefore
        the "mov" instruction cannot be here.

        In this case, IDA automatically destroys the instruction(s)
        and enlists the address as problematic.

 What to do:
        Examine the end result and modify it accordingly.
Description:
        It means that IDA recognized the function as coming
        from a standard library but there already was another function
        with the same name in the program.

 What to do:
        Examine the function and rename it as you wish.
 Description:
        IDA matched code bytes against at least one
        signature entry, but failed finding expected
        cross-references at certain offsets in the code.

        Consider the following .pat file contents:

                5589E583EC18A1........890424E8........C9C3...................... 00 0000 0015 :0000 _test ^000F _my_fun0
                5589E583EC18A1........890424E8........C9C3...................... 00 0000 0015 :0000 _smuk ^000F _my_fun1

        Now, turn that .pat file into a signature (.sig) file, telling
        sigmake to include function references into signature
        (using the -r switch).
        Then, apply that .sig file to a binary that you are
        examining.
        If IDA recognizes the 0x15-bytes long pattern in the binary, it
        will check that, at offset 0xF from the start of the match,
        a call to either "_my_fun0" or "_my_fun1" is performed.

        If either one of the two is found, then that code will
        be named "test", or "smuk", respectively.
        Otherwise, a SIGFNREF problem will be signalled.

 What to do:
        Examine the code pointed to by the address at the given
        offset (i.e., 0xF) and try and determine whether
        that function could be "_my_fun0", or "_my_fun1".
        If so, name it accordingly and re-apply the signature.

        An alternative is to generate the signature (.sig)
        file without the cross-references to functions
        (i.e., dropping the '-r' switch).
        But beware of collisions: a pattern like the
        one above will inevitably create a collision, since the
        pattern bytes are similar for the two entries.
        set IDALOG=logfile
Action    name: GraphFunc
 
Action    name: CallFlow
 
Action    name: ChartXrefsTo
 
Action    name: ChartXrefsFrom
 
Action    name: ChartXrefsUser
 
Action    name: WindowOpen
 
Action    name: OpenExports
 
Action    name: OpenImports
 
 Action    name: OpenFunctions
 
        - function name
        - segment that contains the function
        - offset of the function within the segment
        - function length in bytes
        - size (in bytes) of local variables + saved registers
        - size (in bytes) of arguments passed to the function
        R - function returns to the caller
        F - far function
        L - library function
        S - static function
        B - BP based frame. IDA will automatically convert
            all frame pointer [BP+xxx] operands to stack
            variables.
        T - function has type information
        = - Frame pointer is equal to the initial stack pointer
            In this case the frame pointer points to the bottom of the frame
        M - reserved
        S - reserved
        I - reserved
        C - reserved
        D - reserved
        V - reserved
Action    name: OpenNames
 
        L (dark blue)   - library function
        F (dark blue)   - regular function
        C (light blue)  - instruction
        A (dark green)  - string literal
        D (light green) - data
        I (purple)      - imported name
 Action    name: OpenSignatures
 
        - name of file with the signature
        - state of signature:
                - Planned: the signature will be applied
                - Current: the signature is being applied
                - Applied: the signature has been applied
        - number of functions found using the signature
        - description of the signature
Action    name: ShowSegments
 
Action    name: ShowSegmentRegisters
 
 Action    name: ShowSelectors
 
        - jump to the paragraph pointed by the selector
        - add a new selector
        - delete selector (if it is not used by any segment)
        - change selector value (this leads to reanalysis of all program)
Action    name: OpenXrefs
 
Action    name: OpenLocalTypes
 
 Action    name: AddStruct
 
Action    name: CopyStruct
 
 Action    name: DelStruct
 
 Action    name: ExpandStruct
 
 Action    name: ShrinkStruct
 
 Action    name: EditStruct
 
Action    name: AddEnum
 

Action    name: EditEnum
 
        - name of enum
        - its serial number (1,2...)
        - representation of enum members
        1 - the current enum becomes the first enum
        2 - the current enum becomes the second enum
        ...
 Action    name: DelEnum
 
Action    name: AddConst
 
Action    name: EditConst
 
 Action    name: DelConst
 
Action    name: OpenProblems
 
Action    name: OpenTypeLibraries
 
Action    name: OpenStrings
 
        If checked, IDA will ignore instruction/data definitions
        and will try to treat them as strings. If it can build a string
        with the length greater than the minimal length, the string
        will be displayed in the list.
        This setting is ignored if 'only defined strings' is on.
        Allows the user to specify the string types included in the list.
        This setting is ignored if 'only defined strings' is on.
        The minimal length the string must have to be added to the list.
Action    name: OpenCallers
 
Action    name: OpenNotepad
 
Action    name: ShowUndoHistory
 
Local Types window
function window
Add enum type...
Local types window
Open undo history
Open undo history
Open undo history
Open undo history
names window
local types window
define
define
local types window
local types window
name window
selectors
selector
selectors window
selectors

Arrows window

In the graphical version, there is a small window with arrows on the left of the disassembly. These arrows represent the execution flow, namely the branch and jump instructions. The arrow color can be:

        - red: means that the arrow source and destination do not
        belong to the same function. Usually, the branches are
        within functions and the red color will conspicuously
        represent branches from or to different functions.
        - black: the currently selected arrow. The selection
        is made by moving to the beginning or the end of the
        arrow using the Up or Down keys or left-clicking on the arrow
        start or the arrow end. The selection is
        not changed by pressing the PageUp, PageDown, Home, End keys or using
        the scrollbar. This allows to trace the selected arrow far away.
        - grey: all other arrows

The arrow thickness can be:

        - thick: a backward arrow. Backward arrows usually represent
        loops. Thick arrows represent the loops in a clear and
        notable manner.
        - thin: forward arrows.

Finally, the arrows can be solid or dotted. The dotted arrows represent conditional branches when the solid arrows represent unconditional branches.

You can resize the arrows window using a vertical splitter or even fully hide it. If it is hidden, the arrows window will not be visible on the screen but you can reveal it by dragging the splitter to the right. IDA remembers the current arrow window size in the registry when you close the disassembly window.

Browser options

This tab of IDA Options dialog allows for editing of hint and identifier highlight related settings. There are two groups of settings.

The first group is for hints that are displayed when the mouse is hovered over some text.

The second group is for highlighting.

Number of lines for identifier hints

        Specifies how tall the hint window will be initially.
        IDA may decide to display less lines than specified if the hint is
        small. The user can resize the hint window using the mouse wheel.

Delay for identifier hints

        Milliseconds that pass before the hint appears when the user
        hovers the mouse pointer over an identifier

Mouse wheel resizes hint window

        Permit to resize the hint window by using the mouse wheel.
        Can be turned off if the user does not want to resize the hints.

No hints if debugger is active

        Hints will be disabled when the debugger is active. This may be
        useful to speed of debugging: calculating hints for zero filled
        ranges can be very expensive

Auto highlight the current identifier

        Highlight the current identifier everywhere on the screen.
        IDA tries to determine if the current identifier denotes a register.
        In this case it will highlight references to other parts of the
        register. For example, if "AL" is highlighted, IDA will also highlight
        "AH", "AX", and "EAX" (if the current processor is x86).

Unhide collapsed items automatically when jumping to them (gui only)

        If this option is set on, IDA will automatically
        uncollapse hidden functions if the user decides to jump
        to them. As soon as the user quits the function by pressing
        Esc, the function is automatically collapsed again.

Lazy jumps (gui only)

        If this option is set on, IDA will not redraw the
        disassembly window if the jump target is already on the screen.
        In this case, it will just move the cursor to the specified
        address. This option leads to less screen redraws and
        less jumpy behaviour.

Number of items in navigation stack drop-down menus

        Specifies the number of entries in the drop-down menu for the 'Jump'
        toolbar

Number of lines for auto scroll

        Specifies how many lines force automatic scrolling of the
        disassembly view

Caret blinking interval

        Specifies how fast the input caret blinks (in milleseconds).
        Must be greater than or equal to 500, or zero.
        Zero means to disable blinking

Lumina options

Lumina options

Lumina dialog box options

This options tab allows for modification of Lumina credentials and use settings.

Use the public server

        Sets host and port to the default public server hosted by Hex-Rays.
        No username or password is required.

Use a private server

        Allows for setting the name/address and port of a private server.
        If username and password credentials are needed, they can be specified here.

Automatically use Lumina server for analysis

        Instructs IDA to fetch function metadata from the current Lumina server,
        after the initial auto-analysis is complete. This helps with the recognition
        of known functions stored in the database of the Lumina server.

Lumina command line options

Command line switch '-Olumina' overrides for ida session the primary server and '-Osecondary_lumina' the secondary one.

List of options

         host: lumina server host
         port: lumina server port
         user: username for authentification on private lumina
         pass: password for authentification on private lumina
         proxy_host: proxy host
         proxy_port: proxy port
         proxy_user: username for authentification on proxy
         proxy_pass: password for authentification on proxy

Example

  -Osecondary_lumina:host=lumina.hex-rays.com:port=443

Use the public lumina as secondary server for this ida session

Open subviews...
Graphs...
Calculator
View segment registers
View internal flags
Hide
Unhide
Del hidden range
Hide all
Unhide all
Setup hidden items...
Menu Bar
Jump
Menu Bar
set lower limit of suspicious operands
set upper limit of suspicious operands
regular expressions
anchor
anchor
Options
Jump
manually
User-defined operand
instruction
data
undefine
manually
array
String literal
IDA.CFG
View
list
View
graph view
editing
anchor
arrows window
highlights
list viewer
list viewer
names
list viewer
list viewer
list viewer
Edit|Segments
list viewer
list viewer
more
C++ type details
Edit|Operand types...
Convert to offset (automatic)
Convert to offset (from a segment base)
Convert to offset (complex offset expression)
structure
How to Enter an Identifier
How to Enter a Number
bitfield
window
How to Enter a Number
bitfields
list
create string literal
ida.cfg
Undo
Redo
Reset Undo
Disable Undo
jump stack
suspicious operands
instructions
data bytes
unexplored bytes
explored bytes
immediate operand values
substring in the text representation
substring in the binary image of the file
bytes not belonging to any function
find all suspicious operands
string with error
find all errors
pictures (i.e., raster images)
directions
instruction
current direction
defined data
current direction
unexplored
current direction
instruction
data
current direction
search for immediate
Search for substring in the file
search for text
search for text
search for text in core
current direction
suspicious operands
string with error
link
the input string format
Cannot find offset base
Cannot find name
Cannot find alternative string for an operand
Cannot find comment
Cannot find references
Indirect execution flow
Cannot disassemble
Already data or code
Execution flows beyond limits
Too many lines
Failed to trace the value of the stack pointer
Attention! Probably erroneous situation
Decision to convert to instruction/data is made by IDA
The decision made by IDA was wrong and rolled back
FLIRT collision: the function with the given name already exists
FLIRT match indecision: reference to function expected
Convert to offset (DS)
Convert to offset (CS)
Convert to offset by any segment
Convert to offset by any user-specified base
creating
segment
How to change segment attributes
How to move a segment
here
change points
calculating
reload
Additional comment lines
data
string literal
array
undefine
Rename
regular
repeatable
stack pointer
change
Change stack pointer
list
add
delete
modify
Display function flow-chart
Display function call graph
Display chart of xrefs to addresses
Display chart of xrefs from addresses
Display user-defined chart of xrefs
Open disassembly window
Open exports window
Open imports window
Open functions window
Open names window
Open signatures window
Open segments window
Open segment registers window
Open selectors window
Open cross references window
Open local types window
Open problems window
Open type libraries window
Open strings window
Open function calls window
Open notepad
Open undo history
selectors
Types
Type libraries window
Add struct type...
Duplicate a struct type...
Delete struct type...
Insert gap...
Delete gap...
Edit struct type...
Local Types window
Expand
Shrink
Local Types window
Local Types window
Local Types window
Local Types window
Add an enum
Delete an enum
Edit an enum
Define an enum member
Edit an enum member
Delete an enum member
window
parsing

D

A

*

N

Highlighting identifiers

In the graphical version, IDA highlights the identifier under the cursor. For example, if the cursor is on the "EAX" register, then all occurrences of "EAX" will be displayed with the yellow background. This feature is meant to make the program analysis easier by highlighting the interesting parts of the disassembly. For example, if the user wants to see all references to "EAX", he just clicks on any "EAX" on the screen and all of them will be highlighted.

The selection is made by pressing the Up, Down, Left, Right keys or by simply clicking on the identifier.

The selection is not changed by pressing the PageUp, PageDown, Home, End keys, using the scrollbar, or pressing the Alt-Up, Alt-Down, Ctrl-Up, Ctrl-Down keys.

The Alt-Up and Alt-Down keys perform a search of the currently selected identifier backward or forward respectively.

The Ctrl-Up and Ctrl-Down keys scroll the disassembly text.

IDA does not highlight the segment names at the line prefix because it is not very useful.

Database snapshot manager

 Action    name: ShowSnapMan
 

This command shows the database snapshot manager. In this dialog, it is possible to restore previously saved snapshots, rename or delete them.

Note: snapshots work only with regular databases. Unpacked databases do not support them.

Assembler level and C level types

In order to provide intuitive yet powerful interface to types IDA introduces two kinds of types:

  - Assembler level types
  - C level types

Since the user has to specify manually the member offset and other attributes, IDA considers the member offsets to be fixed for them and never shifts members of such types. If a member of struct becomes too big and does not fit the struct anymore, IDA will delete it.

 In the struct/enum view:
  Assembler level types are displayed using regular colors.
  C level types are displayed in gray, as if they are disabled (but they are not).

 In the local types view:
  C level types are displayed using regular colors.
  Assembler level types are displayed in gray, as if they are disabled (but they are not).

View segment registers

You may use this command to refresh the disassembly window too.

Calculator

See also:

Bookmarks window

This command opens the bookmarks window. This window lets the user jump to a specific place in the listing.

Convert to instruction

It is possible to turn off the highlight. The appropriate checkbox is in the tab.

See also commands.

Assembler level types are the ones defined by the user using the or views.

The types defined in the window are considered as C level types. For them IDA automatically calculates the member offsets and if necessary may shift members and change the total struct size.

The user may change the type level by simply editing the type from the appropriate window. For example, if a C level type is edited from the view, IDA will consider such a type as an Assembler level type in the future.

This command displays segment register contents in the .

See also submenu. submenu.

A simple calculator is provided. You can enter constant C-style expressions. Syntax of the expressions is the same is the syntax of IDC . The result is displayed in the message window in three forms: hexadecimal, decimal and character. All the names created during a disassembly may be used in these expressions. IDA can also pick up the name or number under the cursor and to store it into the input line.

submenu

Make Data
Make String Literal
Make Array
Rename
Options, General, Browser
Take database snapshot
Struct
Types
Local types
Struct
 Action    name: ShowRegisters
 
    Action    name: Calculate
 Action    name: OpenBookmarks
 
message window
Edit|Segments
View
expressions
View
How to Enter a Number

Hide all items

 Action    name: HideAll
 

This command allows you to hide:

  • all functions and hidden ranges if invoked in the disassembly window

IDA will display only the header of the hidden items.

View Internal Flags

 Action    name: ShowFlags
 

Hide

 Action    name: Hide
 

This command allows you to hide a part of disassembly. You can hide a function, a segment, or create a special hidden range.

If a range is specified, a special hidden range is created on this range.

If the cursor is on the segment name at the start of the segment, the segment will be hidden. IDA will display only the header of the hidden segment.

Otherwise, the current function will be hidden. IDA will display only the header of the hidden function.

If there is no current function then IDA will beep.

C++ type details

IDA can parse and handle simple C++ class declarations. It cannot parse templates and other complex constructs but simple standard cases can be parsed.

If a C++ class contains virtual functions, IDA will try to rebuild the virtual function table (VFT) for the class. The VFT will be linked to the class by the name: if the class is called "A", the VFT type will be "A_vtbl".

Let us consider the following class hierarchy:

  class A { virtual int f(); int data; };
  class B : public A { virtual int g(); };

IDA will create the following structures:

  struct __cppobj A {A_vtbl *__vftable;int data;}
  struct A_vtbl {int (*f)(A *__hidden this);}
  struct __cppobj B : A {}
  struct B_vtbl {int (*f)(A *__hidden this);
                 int (*g)(B *__hidden this);}

Please note that the VFT pointer in the class A has a special name: "__vftable". This name allows IDA to recognize the pointer as a VFT pointer and treat it accordingly.

Another example of more complex class hierarchy:

  class base1 { virtual int b1(); int data; };
  class base2 { virtual int b2(); int data; };
  class der2 : public base2 { virtual int b2(); int data; };
  class derived : public base1, public der2 { virtual int d(); };

Compiling in 32-bit Visual Studio mode yields the following layout:

  class derived size(20):
        +---
   0    | +--- (base class base1)
   0    | | {vfptr}
   4    | | data
        | +---
   8    | +--- (base class der2)
   8    | | +--- (base class base2)
   8    | | | {vfptr}
  12    | | | data
        | | +---
  16    | | data
        | +---
        +---

IDA will generate the following types:

  struct __cppobj base1 {base1_vtbl *__vftable /*VFT*/;int data;};
  struct /*VFT*/ base1_vtbl {int (*b1)(base1 *__hidden this);};
  struct __cppobj base2 {base2_vtbl *__vftable /*VFT*/;int data;};
  struct /*VFT*/ base2_vtbl {int (*b2)(base2 *__hidden this);};
  struct __cppobj der2 : base2 {int data;};
  struct /*VFT*/ der2_vtbl {int (*b2)(der2 *__hidden this);};
  struct __cppobj derived : base1, der2 {};
  struct /*VFT*/ derived_vtbl {int (*b1)(base1 *__hidden this);
                               int (*d)(derived *__hidden this);};

The 'derived' class will use 2 VFTs:

  offset 0: derived_vtbl
  offset 8: der2_vtbl

IDA and Decompiler can use both VFTs and produce nice code for virtual calls.

Please note that the VFT layout will be different in g++ mode and IDA can handle it too. Therefore it is important to have the target compiler set correctly.

It is possible to build the class hierarchy manually. Just abide by the following rules:

  - VFT pointer must have the "__vftable" name
  - VFT type must follow the "CLASSNAME_vtbl" pattern

C++ classes are marked with "__cppobj" keyword, it influences the class layout. However, this keyword is not required for VFT types.

In the case of a multiple inheritance it is possible to override a virtual table for a secondary base class by declaring a type with the following name: "CLASSNAME_XXXX_vtbl" where XXXX is the offset to the virtual table inside the derived (CLASSNAME) class.

Example: if in the above example we add one more function

        virtual int derived::b2();

Del hidden range

 Action    name: DelHiddenRange
 

Unhide

 Action    name: Unhide
 

This command allows you to unhide a hidden part of disassembly.

If the cursor is on the hidden function name, the function will be unhidden.

If the cursor is on the terse structure variable, the structure will be uncollapsed and displayed in the regular form.

If the cursor is on the hidden range, the hidden range will be unhidden.

If the cursor is on the hidden segment name, the segment will be unhidden.

Unhide all items

This command allows you to unhide:

  • all segments, functions, and hidden ranges if invoked in the disassembly window

If you want to see hidden items on the screen, you may use command or the display of the hidden items.

See also command.

See also submenu

This command displays the internal flag values for the current item. The information appears in the .

See also submenu.

If the cursor is on a structure variable and if the target assembler has the 'can display terse structures or the ' bit on, then the structure will be collapsed into one line and displayed in the terse form.

If you want to see hidden items on the screen, you may use command or the display of the hidden items. If you want to delete a previously created hidden range, you may use command.

See also submenu

then we need one more virtual table. Its name must be "derived_0008_vtbl". Please note that our parser does not create such vtables, you have to do it manually. See also .

This command allows you to delete a hidden range of disassembly (previously defined by using the command).

See also command.

See also submenu

See also command and command.

See also submenu

See also command.

See also submenu.

unhide
enable
Unhide all
Edit|View
message window
View
INFFL_ALLASM
unhide
enable
del hidden range
Edit|View
hide
hide
Edit|View
hide
setup hidden
Edit|View
Local types window
 Action    name: UnhideAll
 
Hide all
Edit|View

Start process

This command starts the process in the debugger. If the process was suspended, it will continue its execution. See also

Pause process

This command pauses a running process. Please note that it is not always possible to pause a process executing the system code. See also

Setup hidden items

Automatically hide library functions

Display hidden instructions

Display hidden functions

Display hidden segments

Process options

This dialog box allows to specify different settings related to the process being debugged.

The hostname, port, and password are not available for debuggers connected locally to the computer. See also

Debugger window

Opens the debugger window.

In this window, you can view the register values for the selected thread. The debugger always selects the thread where the latest debugging event occurred.

For most registers, we have two different boxes:

For a segment register, we only have one box indicating the current value.

For the flags register, we have one box indicating the current value, and small boxes indicating the status of the most important flags.

A popup menu is accessible everywhere in the window, which allows the user to show or hide different parts of the window: toolbar, thread list and available register classes.

Debugger

Here are the debugger commands:

See also

.

This command allows you to toggle the display of items.

See also submenu.

See also .

 Action    name: ProcessStart
 
 Action    name: ProcessPause
 
 Action    name: SetupHidden
 
        This option hides the functions recognized by FLIRT.
        If will have an effect only from the time when the option is set.
        If this option is set, IDA will display all the instructions
        as unhidden even if they were hidden.
        If this options is set, IDA will display all the functions
        as unhidden even if they were hidden.
        If this options is set, IDA will display all the segments
        as unhidden even if they were hidden.
 Action    name: SetupProcess
 
 Action    name: Debugger
 
       - the first box (on the left) indicates the current value of the register.
         Blue indicates that the value has changed since the last debugging event.
         Purple indicates that the value has been modified by the user.
         A popup menu is available on this control, offering different commands.

       - the second box (on the right) shows the current value of the register,
         interpreted like an address (if possible).
Attach to process...
Process options
Pause process
Terminate process
Detach from process
Debugger submenu
Start process
Terminate process
Debugger submenu
hidden
View
Start process
Debugger submenu
How to launch remote debugging
Debugger submenu
Debugger window
Tracing submenu
Thread list
Module list
Start process
Attach to process...
Process options
Pause process
Terminate process
Detach from process
Take memory snapshot
Manual memory regions
Step into
Step over
Run until return
Run to cursor
Set current ip
Show application screen
Breakpoints
Source view
Watches (assembler level)
Tracing
Debugger options
Switch debugger...
Menu Bar
How to launch remote debugging
Debugger for macOS
Debugger for Bochs
Remote GDB debugger
Remote iOS debugger
WinDbg debugger
Replayer debugger
PIN Tracer
Dalvik debugger

Run until return

 Action    name: ThreadRunUntilReturn
 

This command executes assembler instructions and stops on the instruction immediately following the instruction that called the current function.

Internally, IDA executes each instruction in the current function until a 'return from function' instruction is reached.

See also

Application

Host application to launch. When the debugging target (== 'input file') is an executable file, this field is equal to the 'input file'. If this field is wrong, IDA will not be able to launch the program. For remoting debugging, this field denotes a remote file.

Input file

The input file used to create the database. For remoting debugging, this field denotes a remote file.

Directory

Directory to start the application. If empty, then the current directory will be used. For remoting debugging, this field denotes a remote directory.

Parameters

Optional parameters to pass to the debugged application (or the host application) when it starts. This field may be empty. The standard input/output/error channels can be redirected using the bash shell notations. For example: >output 2>&1

Hostname

If entered, denotes the name of the remote host with the application to debug. In this case, a remote IDA server on this host must be launched. to see the list of remote servers.

Port

The port number of the remote server

Password

Optional password to protect your server from strangers connecting to it and running arbitrary commands. The same password switch must be specified on the remote server.

.

Click here
Step into
Step over
Debugger submenu

Terminate process

 Action    name: ProcessTerminate
 

This command terminates the debugged process. See also

Step over

 Action    name: ThreadStepOver
 

This command executes one assembler instruction at a time, stepping over procedures while executing them as a single unit.

Internally, in the case of a function call, IDA setups a temporary breakpoint on the instruction following this function call. See also

Attach to process

 Action    name: ProcessAttach
 

This command displays running processes corresponding to the disassembled file in the database and allows the user to choose a process to attach to.

See also

Step into

 Action    name: ThreadStepInto
 

This command executes one assembler instruction at a time, stepping into functions. See also

Run to cursor

 Action    name: ThreadRunToCursor
 

This command executes instructions until the instruction under the cursor is reached.

.

.

.

.

Internally, IDA setups a temporary breakpoint on the instruction under the cursor. See also .

Start process
Pause process
Detach from process
Debugger submenu
Step into
Run until return
Debugger submenu
Start process
Process options
Pause process
Terminate process
Detach from process
Debugger submenu
Step over
Run until return
Debugger submenu
Debugger submenu

Detach from process

 Action    name: ProcessDetach
 

This command detaches the debugger from the debugged process. Note: this command is only available on Windows XP or Windows 2003 Server !

See also

.

Start process
Pause process
Terminate process
Debugger submenu

Breakpoints

Here are the commands to use the debugger breakpoints.

Related topics:

Breakpoints list

Action    name: Breakpoints
 

Opens the breakpoints window.

In this window, you can view information related to existing breakpoints. Breakpoints are saved in the database, and restored as soon as possible (once the memory becomes writeable).

The 'Pass count' column indicates how many times the program needs to hit the breakpoint before being suspended (0 means "always suspend").

Add breakpoint

Action    name: BreakpointAdd
 

Edit breakpoint

Action    name: BreakpointEdit
 

This command opens a dialog box to edit an existing breakpoint.

Location

  The breakpoint location: either an absolute address, a symbol name,
  a module+offset combination, or a source file name and a line number.
  The exact location syntax depends on the breakpoint kind: absolute, module
  relative, symbolic, or source code.

Settings

  Enabled:
        If the breakpoint is enabled or disabled. Disabled breakpoints
        are not written to the debugged process.

  Hardware:
        If enabled, IDA will use a hardware breakpoint. The breakpoint
        mode and size must be specified for them (see below).

  Module relative:
        The breakpoint location is stored as a combination of a module
        name and an offset. This kind of breakpoint is useful for
        DLLs that are loaded to various addresses because their addresses
        cannot be calculated in advance. Example: kernel32+0x1234

  Symbolic:
        The breakpoint location is stored as a combination of a symbol
        name and a possible offset. This kind of breakpoint is useful for
        symbols that can be imported from different DLLs because their addresses
        cannot be calculated in advance. Example: myfunc+44

  Source code:
        The breakpoint location is stored as a combination of a source file
        name and a line number. Can be used only if the source code of the
        debugged application is available. Example: myfile.cpp:55

Actions

  Break:
        Suspend the debugged application

  Trace:
        Add a new entry to the trace log
  Enable tracing:
        Enable tracing when the breakpoint hits. This is different from trace
        breakpoints (where only a new entry is added to the trace log).

  Disable tracing:
        Disable tracing when the breakpoint fires.
        The access type the breakpoint will react: read/write, write, execute.
  - 2-byte breakpoints must be word-aligned.
  - 4-byte breakpoints must be dword-aligned.

Please note that hardware breakpoints occur AFTER the instruction execution while software breakpoints occur BEFORE the instruction.

Usually, it is easier to use software breakpoints, except if:

  - we want to be sure the memory is not modified by the debugger
  (instruction breakpoints modify the debugged process memory).

  - we want to detect accesses to data bytes.

  - the specified address is write protected (really rare!).

See also

Delete breakpoint

Action    name: BreakpointDel
 

This command deletes an existing breakpoint at the current address.

Page breakpoints

Page breakpoints are memory access breakpoints that can be set to detect when the application reads, writes, or executes code/data in a specific memory range. Page breakpoints are very similar to hardware breakpoints but there is no limitation on the number of page breakpoints that can be set or their size, in contrast with normal hardware breakpoints.

Memory access breakpoints are implemented by removing page permissions according to the specified type of the page breakpoint to be added (for example, for a write page breakpoint, the write permission will be removed from the page). When the access violation exception occurs because the application tries to access the specific memory region, IDA reports a breakpoint hit.

As page breakpoints can be set for a small part of a memory page but the permissions of the whole page must be changed, page breakpoints can slow down the debugger because many access violation exceptions may be generated. If the application accesses memory outside of the desired range but on the same page, the generated exception must be silently handled and the application resumed. Specifically, page breakpoints in the code segment can slow down the debugger very much.

Memory access breakpoints are supported since IDA version 6.3 for the following debuggers:

Win32

  Page breakpoints are supported for both local and remote debugging
  of 32 and 64bit applications.

WinDbg

  Page breakpoints are supported only for local debugging of 32-bit applications.

Bochs

  Page breakpoints are supported for both of 32 and 64bit applications.
  Page breakpoints in the bochs debugger are just like normal hardware
  breakpoints but with no limit on the number of breakpoints or their size.
  Please note that hardware breakpoints in the bochs debugger occur AFTER the
  instruction is executed while regular page breakpoints occur BEFORE the
  instruction is actually executed.

Find breakpoint

Action    name: BreakpointFind
 

Open the breakpoints window if needed, then find current breakpoint in it.

Breakpoint conditions

Expressions

  If you enter an expression, the result will be used to determine whether
  the selected actions are executed. Some examples of IDC expressions:

  Check if EAX is equal to 5:

    EAX==5

  Check if the first argument to the function is 1:

    get_wide_dword(ESP)==1

  Interpret the second argument to the function as a pointer to Unicode string, print it,
  and return 0 (so that the execution continues immediately):

    msg("Filename: %s\n", get_strlit_contents(get_wide_dword(ESP+4), -1, STRTYPE_UNICODE)), 0

  Set EAX to 0 and continue:

    EAX=0,0

Statements

  You can enter several statements in the multi-line editor. If the last one is a 'return' statement,
  it is used as the result of the condition. Otherwise the condition is assumed to return 0.

See also

Low level breakpoint conditions

Low level breakpoint conditions can be used to speed up the debugger. They are evaluated like this:

  - in case of remote debugging, the condition is evaluated on the remote
    computer. The following actions are bypassed:
      - sending of the breakpoint event to the local computer
      - switching from debthread to the main thread
      - updating internal IDA structures and caches
      - updating the screen

  - in case of local debugging, the condition is evaluated at low level.
    The following actions are bypassed:
      - switching from debthread to the main thread
      - updating internal IDA structures and caches
      - updating the screen

In both cases, there is a significant speed up. This improvement imposes some limitations on the breakpoint condition:

  • only functions marked as 'thread-safe' may be called

  • only entire registers can be accessed (e.g. EAX is ok but AL is not) Essentially this means that the only available functions are:

    - read/write process registers
    - read/write process memory
    - file i/o
    - auxiliary string and object functions
    - msg() function (for debugging the breakpoint conditions)

Low level breakpoint conditions are available only for Win32, Linux, Mac, and Android debuggers.

Show application screen

This command displays the application screen.

It is useful for the text mode debugger.

When the debugged application runs in the same window as IDA itself, the application output is hidden by IDA windows. This command allows to see the application screen in this case.

To return to IDA display, press any key.

Set current ip

This command sets the instruction pointer of the current suspended thread to the current cursor location.

Watches

Here are the commands to use the debugger watches (assembler level).

See also

Watch list

Opens the assembler level watch list window.

In this window you can view memorized watches. A watch allows the user to continuously see the value of a defined item.

Add watch

Delete watch

This command deletes an existing watch.

Tracing

Here are the commands to use the tracing features of the debugger.

Trace management

Saved binary trace files can be loaded, saved and replayed with the new replayer debugger module, diffed against other traces (to spot differences between executions) or displayed in a proximity view (displaying the execution call graph).

Tracing window

Opens the 'Tracing' window.

During the execution, the list of traced events is disabled, as it couldn't be continuously synchronized with the execution without rendering the whole tracing very slow.

If a '=' character is displayed in the 'Thread' and 'Address' columns, it indicates that the trace event occurred in the same thread and at the same address as the previous trace event.

Select trace

Load a binary trace file in the 'Tracing' window.

Other options

Show a dialog with additional options for managing trace files.

This command displays a window with all the available commands to manage trace files.

Edit trace description

Show the description of a binary trace file.

This command displays a window with the description of a selected binary trace file and allows to edit it.

Diff to binary trace

Diff the currently loaded trace against a recorded trace.

This command displays a window to select a trace file to diff against the currently loaded trace, displayed in the 'Tracing' window.

Remove binary trace

Delete a binary trace file from disk.

This command displays a window to select a recorded trace file to delete from disk.

Import binary trace

Import a binary trace file from a different IDB.

This command allows to import binary trace files recorded for an IDB with a different MD5. For example, it can be used to load recorded traces from a malware sample which is practically the same, but differs in a few bytes.

Export binary trace

Export to a binary trace file all events displayed in the 'Tracing' window.

Export trace to text file

Export to a text file all events displayed in the 'Tracing' window

Show trace callgraph

Show the callgraph of the loaded trace in a proximity view.

This command displays the callgraph of the currently loaded trace in a proximity view.

Clear trace

Instruction tracing

This command starts instruction tracing. You can then use all the debugger commands as usual: the debugger will save all the modified register values for each instruction.

Internally, the debugger runs the current thread step by step to properly obtain all the required register values. This explains why instruction tracing is slower than a normal execution.

Function tracing

This command starts function tracing. You can then use all debugger commands as usual: the debugger will save all addresses where a call to a function or a return from a function occurred.

Internally, the debugger runs the current thread step by step to properly detect all function calls and returns. This explains why functions tracing is slower than a normal execution.

Basic block tracing

This command starts basic block tracing. You can then use all debugger commands as usual: the debugger will save all addresses where a temporary basic block breakpoint was reached.

Internally, the debugger runs the current thread normally, setting temporary breakpoints in the last instruction of every basic block of every function referenced from the current function and also at any call instruction in the middle of the traced basic blocks.

Basic block tracing is slower than normal execution but faster than instruction or function tracing.

Add write trace

This command adds a write trace to the current address.

In fact, write traces are nothing more than breakpoints with special properties: they don't stop and they simply add a trace event when the breakpoints are reached.

Add read/write trace

This command adds a read/write trace to the current address.

In fact, read/write traces are nothing more than breakpoints with special properties: they don't stop and they simply add a trace event when the breakpoints are reached.

Add execution trace

This command adds an execution trace to the current address.

In fact, execution traces are nothing more than breakpoints with special properties: they don't stop and they simply add a trace event when the breakpoints are reached.

Internally, the debugger will add a breakpoint instruction at the given address.

Stack trace

Opens the stack trace window.

This window displays the function calls that brought the current instruction.

The top of the Stack Trace window lists the last function called by the program. Below this is the listing for the previously called functions. Each line indicates the name of the function which called the function represented by the previous line.

Double clicking on a line jumps to the exact address of the instruction realizing this call.

Currently, IDA uses the EBP frame pointer values to gather the stack trace information. It will fail for functions using other methods for the frame.

Tracing options

This dialog box allows you to specify different settings related to the tracing features.

Trace buffer size

Trace file

Trace directory

Stop condition

Tracing

  • memorize the return address associated with the last executed call instruction in database segments (the previously saved one is overwritten).

  • setup a temporary breakpoint on this address once the IP is in a debugger segment or library function, disable step by step, and run the thread.

  • reenable step by step once this temporary breakpoint is reached.

Highlight

Instruction tracing

Function tracing

Basic block tracing

See also .

This command adds a breakpoint at the current address. If an instruction exists at this address, an instruction breakpoint is created. Otherwise, IDA offers to create a hardware breakpoint and allows the user to . Hardware breakpoints can be either real hardware breakpoints or .

Condition This expression will be evaluated each time the breakpoint is reached. If the expression returns true (non-zero), the debugger will execute the selected actions. Please note that you can use the register names in the IDC scripts when the debugger is active. Tests like this are allowed, for example: EAX == EBX+5 or get_wide_dword(ESP+0x10) == 34 You can also use the "..." button to enter a multiline condition, or specify another scripting language to use. See for more info.

Low level condition: Evaluate the condition on the remote computer. Such conditions are faster, especially during remote debugging, because there is no network traffic between IDA and the remote computer on each breakpoint hit.

Refresh debugger memory: By default IDA does not refresh the memory config before evaluating a breakpoint condition. This option enables the refresh. To refresh it manually, call

Tracing type: , and level tracing types can be selected for breakpoints where enable/disable tracing have been selected. Hardware breakpoint size Number of bytes to watch: 1, 2 or 4 bytes for normal hardware breakpoints. Any size for . Hardware breakpoint mode

In the case of Intel hardware breakpoints, some limitations are enforced (in contrast with ). It is impossible to create more than 4 hardware breakpoints. The address of the breakpoint must be aligned appropriately:

You can use the "Condition" field of the breakpoint properties to enter an expression which is evaluated when the breakpoint is hit. It can be either an actual condition or just any valid code in or another supported scripting language syntax. By using the "..." button, you can open a multi-line editor for the condition and switch the scripting language used for evaluating it.

only expressions can be used for low level conditions

This command is available when the application is suspended or finished. See also .

It is accessible only when the debugger is active and the process is suspended. See also .

This command adds a watch at the current address. The watch is visible in the .

See also .

Recorded traces can be managed from the . Traces are saved in a directory specified in the dialog.

In this window, you can view some information related to all traced events. The tracing events are the information saved during the execution of a program. Different type of trace events are available: , and , or .

This command displays all the saved trace files that correspond to the MD5 of the current IDB and allows the user to load one of them. The traces can be replayed with the , inspected manually in the disassembly view or displayed as a callgraph in a proximity view.

If highlight options are enabled in , instructions from the currently loaded trace will be displayed with the background "main color" and instructions from the diff trace file will be displayed with the "diff color". Common instructions will be highlighted with an average of the two.

This command exports to a binary trace file the current trace being displayed in the . The trace can be loaded later, removed or diffed against other trace files.

This command exports the current trace being displayed in the to a text file.

This command removes all trace events from the . It also removes any loaded trace file used for against the currently loaded trace.

When you click on an instruction trace event in the 'Tracing' window, IDA displays the corresponding register values preceding the execution of this instruction. In the 'Result' column of the , you can also see which registers were modified by this instruction. By using this information, you can for example quickly determine which instruction modified a specific register, or you can even backtrace the execution flow. Note that the IP register is never printed in the 'Result' column, although it is usually modified by almost any instruction (except perhaps some prefixed instructions like REP MOVSB, ...).

Each time the given address will be accessed in write mode, the debugger will add a trace event to the .

Internally, the debugger will add a hardware breakpoint on the given address, so all the restrictions for are also valid for write traces.

Each time the given address will be accessed in read or write mode, the debugger will add a trace event to the .

Internally, the debugger will add a hardware breakpoint on the given address, so all the restrictions for are also valid for read/write traces.

Each time the instruction at the given address will be run, the debugger will add a trace event to the .

This expression will be evaluated before the execution of each instruction. If the expression returns true, the debugger will suspend the execution. Please note that you can use register names in the condition.

Enabling these options will speed up the execution, as many instructions (from debugger segments and/or library functions) will not be traced. Disabling these options can quickly fill the , as all instructions in DLLs and system functions will be executed step by step. Notice that both options influence the way instruction and function tracings will work. Internally, the debugger proceeds like this:

Debugger submenu
refresh_debugger_memory
Index of IDC functions
IDC
Index of IDC functions
IDC
Breakpoints list
Add breakpoint
Edit breakpoint
Delete breakpoint
Page breakpoints
Find breakpoint
Breakpoint conditions
Low level breakpoint conditions
edit breakpoint settings
page breakpoints
IDC
here
More details
page breakpoints
 Action    name: ShowUserScreen
 
 Action    name: ThreadSetCurrentIp
 
Action    name: WatchList
 
Action    name: AddWatch
 
Action    name: DelWatch
 
Action    name: TracingWindow
 
Action    name: ClearTrace
 
Action    name: ToggleTraceInstructions
 
Action    name: ToggleTraceFunctions
 
Action    name: ToggleTraceBasicBlocks
 
 Action    name: WriteTraceAdd
 
Action    name: ReadWriteTraceAdd
 
Action    name: StackTrace
 
Action    name: SetupTracing
  This setting indicates how many tracing events can fit in the trace buffer.
  If the debugger must insert a new event and the buffer is full,
  the oldest tracing event will be removed.
  However, if you specify a size of 0, the buffer size isn't limited.
  Notice that, for example, in the case of an instructions trace,
  all executed instructions could be logged, which would quickly fill
  up the memory!
  If a filename is specified, all future traced events will be appended to it.
  The directory were trace files for the current database will be saved. If not
  specified, the IDB directory will be used.
  - Trace over debugger segments

      If selected, the debugger will not go step by step in debugger segments
      (segments not available in the database).

  - Trace over library functions

      If selected, the debugger will not go step by step in library functions.
- Do not log already logged IP

    If selected, already executed instructions will not be logged if
    they are executed again.

- Skip loops

    If selected, tracing will be temporarily disabled for some loops
    constructs.
  - Highlight instructions in IDA views

    If selected, recorded instructions will be displayed in IDA views (disassembly
    views) with a different background color.

  - Main color

    The main background color for traced instructions.

  - Diff color

    The background color for the instructions recorded and being diffed against the
    currently loaded trace.
  - Log if same IP

    If selected, the debugger will also log all register modifications occurring
    during the execution of prefixed instructions like REP MOVSB, ...
  - Log return instructions

      If selected, the debugger will also log function returns.
      If disabled, only function calls are logged.
  - Log basic block instructions

      If selected, all instructions from the current basic block will be logged
      and displayed in the 'Tracing' window, instead of only the last instruction of
      the basic block.
page breakpoints
Instruction
Function
Basic block

Source code view

This window shows the contents of a source code file. IDA automatically opens source views provided that proper mapping of the source code paths is specified in "Options, Source paths".

This window may also display a decompilation result because it is considered as a source code. This can be useful if the source files are not available.

Watch view (source level)

In this window the user can view values of selected variables.

Global variables (data item names) as well as variables that are local to the current function can be added by pressing Ins.

Expressions can be added to the view as well, they will be considered as IDC expressions.

Expressions may have a type cast at the beginning. For example

(int)0x12345678

means that the contents of the memory at the address 0x12345678 should be displayed as an integer. Note: to display strings use "char[]" as the typo.

Locals view (source level)

This window displays the values of the variables that are local to the current functions (register and stack based).

Debugger submenu
Debugger submenu
Debugger submenu
Debugger submenu
replayer debugger
IDC
Watch list
Add watch
Del watch
Watch list window
Trace management
Tracing window
Clear trace
Instruction tracing
Function tracing
Basic block tracing
Add write trace
Add read/write trace
Add execution trace
Stack trace
Tracing options
Tracing window
tracing options
instruction tracing events
function tracing events
write
read/write
execution tracing events
Tracing Options
Tracing window
Tracing window
Tracing window
diffing
Tracing window
Tracing window
Tracing window
Tracing window
Tracing window
hardware breakpoints
hardware breakpoints
Watch view (source level)
Source level watchies

Watch view (source level)

In this window the user can view values of selected variables.

Global variables (data item names) as well as variables that are local to the current function can be added by pressing Ins.

Expressions can be added to the view as well, they will be considered as IDC expressions.

Expressions may have a type cast at the beginning. For example

(int)0x12345678

means that the contents of the memory at the address 0x12345678 should be displayed as an integer. Note: to display strings use "char[]" as the typo.

See also

Source code view
analysis options
compiler setup
dummy
Autoanalysis
setup data
target assembler
assembler
Set String Style
margin
dummy
Names representation
assembler
assembler
Comments Dialog
Comments Dialog
Comments Dialog
Kernel Options
dummy
Names representation
target assembler
Comments Dialog
Dummy
Names representation
Comments Dialog
indicator
processor
processor
cross-references
compiler setup
Working with types
here
How to choose a function
Choose marked location