Graph view

In the graph view, the current function is represented as a collection of nodes linked together with edges. Nodes represent basic blocks and edges represent code cross-references between them.

Only code items are visible in the graph view, data items are hidden. To display them, switch to text mode by pressing Space. The graph view is available for the instructions belonging to functions. IDA automatically switches to text mode if the current item cannot be displayed in graph mode. It also displays a warning, which we recommend to hide away as soon as you become familiar with the concept.

The Space key can be used to toggle between the graph and text views.

Please select one of the following topic to learn more about graphs:

The current node

There are two concepts: the current node and the selected nodes. The node with the keyboard cursor is considered as the current node. If the user clicks on the graph background, the keyboard cursor will disappear and there will be no current node. In the absence of the current node, IDA uses the last valid address for the user commands (like rename and similar commands). For example, if the user invokes the 'rename' command by pressing N and if there is no current node, IDA will still display the 'rename' dialog box for the last valid address.

Clicking on the node title will make the clicked node the current one. The keyboard cursor will be moved to the clicked node. Any selection of the disassembly text will be cancelled upon switching the current node.

The default color for the title of the current node is dark gray.

In addition to the obvious method of clicking with the mouse left-button to select the current node, IDA supports many other methods:

 - Clicking with the mouse wheel selects the clicked node and centers
   the clicked point in the window
 - Keyboard arrows can be used to move from one node to another. When
   the keyboard cursor reaches the node border and the user presses
   the arrow once more, IDA finds a node in the specified direction
   and makes it the current.
 - The Ctrl-Up key displays the list of nodes referring to the current
   node and allows jumping to them. The Ctrl-Down key does the same
   with the referenced nodes.
 - Pressing '5' on the keypad positions the keyboard cursor at
   the window center
 - Left-click on an edge makes one of its ends (source or destination)
   the current node. The node farthest from the click point is selected
 - Ctrl-click on an edge jumps to its destination
 - Alt-click on an edge jumps to its source

Clicking with the mouse on the node text (disassembly listing) has the usual meaning: IDA will move the keyboard cursor to the clicked location. It is also possible to select the disassembly listing within one node.

Selections in graphs

Many graph operations are applied to the selected nodes. The current node is considered to be part of the node selection for all operations.

The graph nodes can be selected using the mouse. To select many nodes at once, press and hold the Ctrl key during the mouse operation. The Alt key removes nodes from the current selection.

Internally, IDA keeps track of the selected nodes and edge layout points. Edge layout points are the points where edges are bent. If the current selection is moved in the graph, the selected edge layout points are moved too.

The default color for the title of the selected nodes is light gray. Other node titles are displayed with white color.

See also proximity view.

Customizing graph layout

Each node has a title bar with title buttons. The title bar can be used to displace the node. Displacing nodes or edges creates a custom layout. The custom layouts are automatically saved in the database. If there is a custom layout for the function, IDA never destroys it without your explicit permission. This behavior has its drawbacks: when the nodes are resized (because of added comments, for example), the old layout will be retained and the nodes could overlap. In this case, the user can ask IDA to redo the layout or manually move the overlapping nodes. To avoid displacing nodes inadvertently, turn on the lock graph layout option.

The user can also click on the edge layout points (edge bending points) and drag them. If two edge layout points are too close, one of them will be deleted. To create new edge layout points, use Shift-DoubleClick on the edge.

Zooming graphs

The graph can be zoomed in and out. There are several ways of zooming the graph:

 - Use Ctrl-Wheel. The current mouse position will be the zoom center
   point (i.e. this point will not move during the zoom operation)
 - Use the predefined 'Zoom 100%' and 'Fit window' commands. They are
   available from the right-click menu or by their shortcuts: '1' and
   'W' respectively. The current mouse position is the zoom center
   point for the 'zoom 100%' command.
 - Use Ctrl-KeypadPlus or Ctrl-KeypadMinus keys. The current keyboard
   cursor is the zoom center for these commands.
 - Use Ctrl-Shift-drag. This lets you draw a rectangle to which IDA
   will zoom.

There are two options linked to the graph zooming:

 - Auto fit graph to window: will fit the current graph to the window
   size. Default: off
 - Fit window max zoom level 100%: the 'fit window' command does not
   use zoom levels higher than 100%. Default: on

The zoom level is never greater than 1000% and less than 1%. IDA remembers the current zoom level for each location in the navigation history.

See also proximity view.

Scrolling graphs

The user can pan (shift) the graph by clicking with the left mouse button on the graph background and dragging it. In the rare case when there is no graph background visible on the screen, the Shift-click can be used to move the graph. This can happen on very high zoom levels, when the current node occupies the whole window.

The mouse wheel scrolls the graph vertically. If the Alt key is pressed, it will scroll the graph horizontally.

The Page Up and Page Down keys scroll the graph vertically. The keyboard arrows can scroll the graph if they reach the node border and cannot jump to another node in the specified direction.

Scrolling the graph does not change the keyboard cursor position. As soon as the graph is refreshed on the screen, IDA will scroll the graph so that the keyboard cursor becomes visible.

See also proximity view.

Graph node groups

Any number of nodes can be collapsed into a single synthetic node. Such a synthetic node contains a user-provided text instead of normal disassembly listing. The 'group' command is available from the right-click menu if there are selected nodes.

Even a single node can be used to create a group. This feature can be used to collapse huge nodes into something manageable or to hide a group that consists of one node.

After creating a group, IDA automatically refreshes the graph layout. If a custom layout was present, it is not applied to the reduced graph. However, the existing custom layout is not destroyed and will be re-used as soon as the user switches to the full graph by deleting the group or uncollapsing it.

The node groups can be nested: synthetic nodes can be used to create other groups. This feature allows reducing the graph into a single node. Each node can belong to only one group at a time.

Groups can be uncollapsed to display the original node content. The node frames of the current uncollapsed group (the one with the mouse pointer) are displayed with a special color. The default group frame color is yellow. This way, the existing uncollapsed groups can be visualized by hovering the mouse over the graph nodes.

There are also commands to collapse and uncollapse all groups in the graph. They are available from the right click menu.

To edit the contents of synthetic nodes, use the 'set node text' button on the node title. The 'rename' command can be used too.

IDA automatically remembers the graph groups and their state for each function.

Graph overview window

IDA has a small graph overview window. It displays the whole graph in the zoom out form and gives the user an idea about which part of the graph is visualized on the main window.

Clicking on the graph overview window visualizes different parts of the graph in the main window. It is also possible to click and drag the focus frame - the main window will be refreshed accordingly.

The graph overview window is visible only in the graph view node. As soon as another non-modal window gets focus, the graph overview is closed. It automatically opens when a graph view is activated.

The graph overview is displayed by default. To hide it, right click on the main toolbar background and select Navigation, Graph overview menu item.

The graph overview window can be resized to accommodate really huge graphs.

Graph colors

Graph edges can have several colors. In graph view:

 - Blue: a normal edge
 - Green: if the jump is taken (its condition is satisfied)
 - Red: if the jump is not taken
 - Blinking: when in the debugger, the edge that will be followed blinks

And, in proximity view:

 - Blue: Code cross-reference edge
 - Gray: Data cross-reference edge

IDA highlights the current mouse items. If the mouse is hovered over an edge, it is highlighted. If the mouse is hovered over a node, all adjacent edges are highlighted. To turn off the highlighting, specify the 'current edge' color as an undefined custom color.

The 'highlighted edge' and 'foreign node' colors are not used yet.

See also proximity view.

Graph options

Use graph view by default

        IDA switches to graph mode for each 'jump' command.

Enable graph animation

        Animate the graph layout, movement, and group collapsing/uncollapsing.
        While animation takes time, it gives the user some idea what's going on.

Draw node shadows

        Display shadows for each graph node. Shadows are not displayed
        for really huge or ridiculously small nodes.

Auto fit graph into window

        Zoom the graph so that it occupies the whole window.

Fit window max zoom level 100%

        The 'fit window' command maximal zoom level is 100%.

Re-layout graph if nodes overlap

        IDA recomputes the graph layout if a node overlap is detected.
        The presence of a custom layout (if the user has displaced
        some graph nodes) effectively turns off this option.

Re-layout graph upon screen refresh

        IDA recomputes the graph layout at each screen refresh.
        Turning this option off accelerates IDA but then
        a manual layout might be required after some operations.

Truncate at the right margin

        All nodes at truncated at the right margin. The right margin
        is specified in the Options, General, Disassembly tab.
        This option narrows the graph but hides some information
        by truncating long lines.

Lock graph layout

        Locks the graph layout by ignoring attempts to displace
        nodes. This prevents the creation of custom layouts that might lead
        to ugly graph layouts when nodes change their sizes.

PROXIMITY VIEW

Show data references

        Show data cross-referenced items in proximity view.

Hide library functions

        Do not show data or code cross-references to library functions,
        only show cross-referenced local functions.

Unlimited children recursion

        Recurse until there are no more callees (children) of the currently
        selected central node and all of his children.

Recurse into library functions

        Displays children data or code cross-references from library
        functions.

Max parents recursion

        Maximum recursion level for displaying parents of the currently
        selected central node. The value '0' disables parents recursion.

Max children recursion

        Maximum recursion level for displaying children of the currently
        selected central node. The value '0' means no maximum recursion
        level.

Max nodes per level

        Maximum number of nodes to show per level of children and parents.

See also: right margin

Various graph hints

  1. The following actions can improve the speed of graph drawing:

 - Turn off animation
 - Turn off node shadows
 - Specify identical top and bottom background colors
 - Turn off 'relayout' options (might lead to stale graph contents)
 - Turn off the graph overview window

  1. Printing the graph: the 'print' command is available at the graph toolbar. The graph toolbar is visible by default but if you have saved a custom desktop configuration in the past, it will not be visible. To set it on, check the View, Toolbars, Graph view menu item.

  2. Working with huge graphs: do not forget about the node groups and use them to make the graph simpler.

Last updated