Deep Links

Deep links are URLs that point to a specific location inside an IDA database. They use the custom ida:// scheme and can be:

• copied to the clipboard from any list or code view in IDA,

• pasted into chat, tickets, mail, or browser so a teammate can click through and land at the exact same place,

• followed from anywhere on your system — clicking an ida:// link in a browser launches IDA (or jumps to an already-running instance) on the right database, at the right address, in the right view,

• generated and consumed programmatically from IDAPython or C/C++ plugins.

A deep link identifies:

• the source the database lives in (a named directory of IDBs, optional),

• the database the link refers to (by file name, optional),

• the resource to navigate to (a function, an address, a string, a type, …),

• the exact target within that resource (typically an RVA or an EA, or a name for types),

• and, optionally, the view in which to display it (disassembly, pseudocode, hex dump, graph, …).

How it fits together

There are two halves to the system. They are useful independently, but they combine to make ida:// links a first-class navigation mechanism across IDA, the operating system, and your team.

Inside IDA

The IDA Pro GUI generates and consumes ida:// URLs natively:

• Copy link (action from contextual menu) on any list or code view produces a deep link to the current selection.

• Jump → Jump to link… asks for an ida:// URL and navigates to it.

• The open_ida_link() API (C/C++ and IDAPython) lets plugins and scripts perform the same navigation programmatically.

Inside one IDA instance, this works without any extra setup.

Across processes — HCLI

When you click an ida:// link in a different application (a browser, a chat client, a ticket), the OS needs to know who handles the ida scheme. That role is filled by HCLI, the Hex-Rays command-line companion tool (Learn more about HCLI).

Once hcli ida protocol register has been run, every ida:// link clicked anywhere on the system goes through hcli, which then:

1. Connects to a small IPC server that runs in every IDA 9.4+ instance (over Unix sockets on Linux/macOS and named pipes on Windows). Each instance advertises which IDB it has open.

2. Discovers running instances and finds one whose IDB matches the link. If it does, the link is forwarded into that instance via IPC and the navigation happens in place — no new window.

3. If no instance has the IDB, launches IDA with the right IDB file, then waits for auto-analysis and forwards the link.

This is the part that makes deep links shareable across machines, teams, and external tools — not just inside one IDA window.

URL format

ida://<source>/<idb-name>/<resource>?<params>

Component	Meaning
source	Optional. A named source registered with hcli (see below). Empty for the local machine.
idb-name	The basename of the database file (e.g. myfile.i64). Optional in some forms.
resource	One of the resource names from the table below.
params	A standard URL query string (?key=value&key=value).

The accepted forms are:

Form	Meaning
ida:///<resource>?…	"Whichever IDA is open." Routed to the only running instance with an IDB loaded.
ida:///<idb-name>/<resource>?…	Specific IDB by name. hcli searches all configured sources (and running instances).
ida://<source>/<idb-name>/<resource>?…	Specific IDB inside a named source. hcli resolves the source to a directory.
ida://<host[:port]>/api/v1/buckets/<bucket>/assets/<key>	A Knowledge Exchange link. hcli downloads the asset and opens it.

hcli accepts the special source name localhost to mean "search the local machine, but write the URL in the absolute (non-relative) form" — useful when an embedding context dislikes the ida:/// triple-slash.

When an ida:// link is handled inside a running IDA instance and an idb-name is present that does not match the open database, IDA prints a warning to the Output window but still attempts the navigation.

Query parameters

Parameter	Used by	Description
rva	All resources except types	Target address as relative virtual address (image-base relative).
ea	All resources except types	Target address as absolute effective address.
name	types	Type name.
view	All resources	Selects which view to open (see Views).

ea and rva are mutually exclusive. rva is the recommended form for shareable links because it is independent of ASLR and rebasing — the same RVA resolves correctly on a teammate's machine even if the binary loaded at a different base address.

Numbers may be written in decimal or hexadecimal (0x prefix).

Resources

Resource	Refers to	Required key
functions	A function (resolved by start address).	rva/ea
addresses	Any mapped address.	rva/ea
strings	A string literal at the given address.	rva/ea
segments	The segment containing the given address.	rva/ea
names	A named location.	rva/ea
imports	An import entry.	rva/ea
exports	An export entry point.	rva/ea
types	A local type by name.	name
bookmarks	A bookmarked address.	rva/ea

If the resource cannot be resolved (e.g. functions?rva=… pointing outside any function, or types?name=… referring to an unknown type), the link is reported as invalid in the Output window and no navigation happens.

Views

The optional view parameter chooses which window IDA should open or focus when navigating. Each resource has a default view, listed below.

View name	Target window
disasm	Disassembly (flat listing).
graph	Disassembly (graph mode).
pseudocode	Decompiler pseudocode.
hexdump	Hex dump.
functions	Functions list.
segments	Segments list.
names	Names list.
imports	Imports list.
exports	Exports list.
strings	Strings list.
types	Local Types.
bookmarks	Bookmarks list.

Not every view is meaningful for every resource. The compatibility table below reflects the validation IDA performs:

Resource	Default view	Allowed views
functions	functions	disasm, graph, hexdump, pseudocode, functions
addresses	disasm	disasm, hexdump
strings	strings	disasm, hexdump, strings
segments	segments	disasm, hexdump, segments
names	names	disasm, hexdump, names
imports	imports	disasm, hexdump, imports
exports	exports	disasm, hexdump, exports
types	types	types
bookmarks	disasm	disasm, graph, hexdump, pseudocode, bookmarks

If view is omitted, IDA uses the default view for the resource. If view is incompatible with the resource, the link is rejected with an error message that lists the allowed views.

Examples

# Inside one IDA instance: jump from script or "Jump to link…"
ida:///functions?rva=0x1240
ida:///functions?rva=0x1240&view=pseudocode
ida:///addresses?ea=0x401000
ida:///myfile.i64/strings?rva=0x21a0
ida:///types?name=MyStruct
ida:///bookmarks?rva=0x1240&view=graph

# Routed through hcli — uses a named source registered on the recipient's machine
ida://malware-samples/trojan1.i64/functions?rva=0x1000
ida://malware-samples/trojan1.i64/functions?rva=0x1000&view=pseudocode

# Knowledge Exchange — hcli downloads the asset before opening it
ida://ke.example.com/api/v1/buckets/mybucket/assets/mykey

What's next?

For a practical tutorial covering typical use cases, such as copying your links, configuring HCLI for system-wide handling, or generating links from a script — see Using Deep Links.